Online shops on Magento and Adobe Commerce need the July update.

What's happening.

Adobe's bulletin APSB26-73, published on 14 July 2026, fixed 14 flaws in Adobe Commerce and Magento. Eight are rated critical. One, CVE-2026-48356, lets an attacker upload a dangerous file and run code, and it needs no login.

CISA added that flaw to its list of exploited vulnerabilities on 27 October 2026. That means attackers are using it against shops that have not applied the July update.

What it means for you.

An attacker who can run code on your shop can take over accounts and sessions, change the shop and read what it stores. For a shop that takes payments or holds customer details, that is a serious data and trust problem.

How to fix it.

1. Update to the July 2026 patch for your version, for example 2.4.8-2026-jul or 2.4.7-2026-jul. Your developer or host will know which applies.
2. Magento Open Source 2.4.5 and 2.4.4 are not listed with a fix. Plan to move to a supported version.
3. Adobe Commerce Events users should update to 1.21.0.
4. Ask your developer or host to check for files you do not recognise in upload folders, and for admin accounts you did not create.
5. Take a full backup before updating, and test checkout afterwards.