CISA says the Magento upload flaw is being exploited. Adobe's bulletin for it still says the company knows of no exploits
2026-10-28Security
CVE-2026-48356 went on the catalogue on 27 October, due 10 November. Adobe shipped the backport on 14 July with a line saying it was not aware of any exploits. Sansec had been logging mass attacks since March.