The facts
CISA describes an unrestricted dangerous-file upload that can execute code in the current user’s context. Adobe classifies the issue as critical and says authentication is not required. [1][2]
Adobe’s CVSS vector specifies user interaction while its record says authentication is not required. The flaw is not described as having no prerequisites. [2]
Affected Commerce branches include 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, and 2.4.4-p18 and earlier. The bulletin also covers affected Magento Open Source releases. [2]
Adobe lists fixed Commerce security releases 2.4.9-2026-jul through 2.4.4-2026-jul; Magento Open Source fixes cover the 2.4.9, 2.4.8, 2.4.7 and 2.4.6 July releases. Administrators should use the bulletin’s product-specific upgrade guidance. [2]
Still unconfirmed
- The checked catalog does not identify victims, an attacker or a campaign’s scale. Ransomware use is listed as unknown.
Corrections & updates
Correction: Filed this cybersecurity report under Security instead of Technology.
Sources
References support the numbered facts above. Source checks: 29 Oct 2026, 01:08 UTC.
CISA and Adobe are separate issuers: the first establishes the exploitation classification and the second the patch/prerequisite details. No claim of independently observing an attack is made. Differing CVSS scores are not used as the significance test.
- Official KEV catalog, 28 October edition
US Cybersecurity and Infrastructure Security Agency · Primary source · 28 Oct 2026
The specific CVE entry was added 27 October; this is the agency’s official GitHub mirror.
- APSB26-73 security bulletin
Adobe · Primary source · 14 Jul 2026
Updated 11 August. Its statement that no exploitation was known then predates CISA’s October listing.