noesis.techLet’s talk
← All field notes

Web estate security

Magento and Adobe Commerce: CISA says attackers are using a flaw Adobe fixed in July

CISA says attackers are using a flaw in Adobe Commerce and Magento that Adobe fixed on 14 July. Control of an administrator’s account could reach prices, orders and customer records. Ask whoever runs your store whether it has the July update, and whether an older Open Source store has any fix.

Noesis · · Source-informed perspective

NOESIS / FIELD GUIDEWeb estate security
At a glanceThe short answer

CISA says attackers are using a flaw in Adobe Commerce and Magento that Adobe fixed on 14 July. An attacker who controls an administrator’s account could reach prices, orders and customer records. Ask whoever runs your store whether it has the July update.

  1. 01Noesis analysis: an administrator can usually change prices, orders, pages and customer records, so that account matters most.
  2. 02Adobe lists Adobe Commerce, Adobe Commerce B2B and Magento Open Source. It does not name fully hosted shops.
  3. 03Adobe lists no fix for Magento Open Source 2.4.4 or 2.4.5. Noesis analysis: those stores probably need an upgrade project.

In plain words

CISA
America’s Cyber Defense Agency. It keeps a list of flaws it says have been used in attacks.
Magento Open Source
The Magento store software that Adobe’s bulletin lists separately from Adobe Commerce.
Administrator account
A staff login with wide control of your store. Noesis analysis: it can usually change prices, pages, orders and customer records.
Fix (update)
A new version of the software that closes the flaw.
CERT-In
India’s national agency for responding to cyber security incidents.
01

CISA says attackers are using a flaw Adobe fixed in July

On 27 October 2026, CISA added a flaw in Adobe Commerce and Magento to its list of flaws it says have been used in attacks. CISA is America’s Cyber Defense Agency. Adobe released a fix on 14 July. The flaw lets someone upload a harmful file to a store. The US National Vulnerability Database says it could let an attacker take control of a user’s account in the store. CISA gave US federal agencies until 10 November to deal with it. Noesis analysis: that date does not bind other businesses, but it is a useful benchmark. See sources 1–3 and 5.

Fig. 1From the sources

From Adobe’s fix to CISA’s listing

  1. Adobe publishes the fixAdobe says it knows of no attacks
  2. Adobe last updates its bulletin
  3. CISA lists the flaw as used in attacks
  4. US vulnerability database record last changed
Dates from the three sources. CISA’s due date of 10 November applies to US federal agencies. The sources do not say when attacks began. Sources 1, 2, 3.
02

Adobe lists four products, including Commerce and Magento Open Source

Adobe’s bulletin lists four products: Adobe Commerce, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events. If your store runs on one of them, ask your developer or host which version you have. The bulletin does not name Shopify or other fully hosted shops. Noesis analysis: on a fully hosted service the vendor runs the software, so ask them to confirm in writing whether this applies. See source 1.

03

An attacker could take control of a user’s account, and an administrator’s matters most

The US National Vulnerability Database says the flaw could let an attacker act as the current user inside the store. That could give the attacker control of the user’s account. The database says a person must first visit a crafted web address or interact with a compromised page. Noesis analysis: an administrator’s account matters most. An administrator can usually change prices, pages, orders and customer records. See sources 2 and 3.

Fig. 2Noesis analysis

What an administrator account can reach

Your revenue

  • Prices
  • Orders

Your customers

  • Customer records

Your brand

  • Pages
Noesis analysis of what an administrator can usually change. Not a report of damage in this case.
04

A break-in costs more than the update

Noesis analysis: for a current store the update is usually a short job. The larger cost sits elsewhere. A store may be offline while it is checked, and sales stop for that time. Customers may need to be told if their data was reached, and some may not come back. There is also a reporting duty. India’s CERT-In directions of 28 April 2022 cover any company, which they call a “body corporate”. They require it to report listed incidents within 6 hours of noticing them. The list includes data breaches and attacks on e-commerce applications. This is not legal advice, so check whether the directions apply to you. Noesis recommendation: the founder or business head should own the decision to report. See source 6.

05

Older Open Source stores may have no fix to install

Adobe’s table lists a fix for Adobe Commerce back to version 2.4.4. For Magento Open Source it lists fixes only from 2.4.6. It lists none for Open Source 2.4.4 or 2.4.5. Noesis analysis: Adobe’s affected list for Open Source reads “2.4.6-p15 and earlier”. Read plainly, that includes 2.4.4 and 2.4.5, so those stores look exposed with no fix listed. Adobe’s support page says extended support for Adobe Commerce 2.4.4 ended on 14 April 2026 and for 2.4.5 on 11 August 2026. That page does not mention Open Source. An Open Source store on 2.4.5 or older probably needs an upgrade project. That takes planning, testing and budget. Ask for a dated plan and for what protects the store until then. See sources 1 and 4.

Fig. 3From the sources

Where Adobe lists a fix

AspectVersions 2.4.4 and 2.4.5Versions 2.4.6 and later
Adobe CommerceFix listedFix listed
Magento Open SourceNo fix listedFix listed
From Adobe’s bulletin table. Adobe’s support page speaks only about Adobe Commerce, so how it applies to Open Source is not covered in this note. Sources 1, 4.
06

Five questions for your developer or host this week

Put these five questions to whoever runs your store. Ask for answers in writing and name an owner for each. Noesis analysis: use CISA’s 10 November date as your own target. First, which edition and version do we run? Second, is Adobe’s July update installed? Third, is there a fix for our version, or a dated upgrade plan with a stopgap? Fourth, have uploaded files and administrator users been reviewed since July? Fifth, who decides whether to report an incident, and to whom? Noesis recommendation: a store that cannot answer the first question quickly has found its first problem. See the figure below.

Fig. 4Noesis analysis

Five answers to get this week

  1. 01Which edition and version do we run?Pass when: A written answer: Adobe Commerce, B2B or Open Source, with the exact version
  2. 02Is the July update installed?Pass when: Each store carries Adobe’s July update, or has a dated plan
  3. 03Is there a fix for our version?Pass when: An older Open Source store has an upgrade plan with dates, and a stopgap
  4. 04Has anything changed since July?Pass when: Uploaded files and administrator users have been reviewed
  5. 05Who decides whether to report?Pass when: A named person knows what to report, to whom, and when
Noesis recommendation, based on Adobe’s and CISA’s notices. Get these answers in writing from whoever runs your store.
07

An update does not prove nobody got in

An update stops new attacks through this flaw. It does not show whether someone came in earlier. The sources do not say how many stores were affected, whether any particular store was attacked, or what attackers did. Adobe’s bulletin says it is not aware of any attacks. That page shows 11 August 2026 as its last update, which is before CISA’s listing, and it showed no later update when we read it on 3 November. We have not tested any store against this flaw.

08

For your technical team.

Forward this section. The flaw is CVE-2026-48356, an unrestricted upload of a file with a dangerous type (CWE-434), in Adobe bulletin APSB26-73. Adobe rates it Critical with a CVSS 3.1 score of 9.6 and no authentication needed. The NVD record, last modified 28 October, scores it 9.3 and says user interaction is required. CISA's KEV entry was added 27 October with a due date of 10 November and known ransomware use "Unknown". Affected: Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier. Magento Open Source: 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier. Adobe lists updated versions named 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul for Open Source, and the same pattern down to 2.4.4 for Adobe Commerce. The B2B module and Commerce Events have their own fixed versions in the bulletin. The bulletin covers 14 flaws, so confirm the whole July update is applied, not only this one. Noesis recommendation: review files uploaded and administrator users added or changed since July. See sources 1–3.

Sources & context

Sources checked 2026-11-03. Recommendations and illustrative scenarios are Noesis’s analysis, not claims of client results.

Your next move

What should
work better?

Bring us the business problem.
We’ll work out the next step together.

Start a conversation

Retained partnerships from ₹1.5 lakh per month.