CVE-2026-48358 is a critical improper output encoding flaw (CVSS 9.1) in Adobe Commerce and Magento. An attacker with high privileges could use it to execute arbitrary code as the current user, with no user interaction. Adobe's bulletin APSB26-73 lists the fixed versions for each release line.
What's affected
The record lists Adobe Commerce, Commerce B2B, I/O Events and Magento without version numbers. The Adobe bulletin page did not load for our review, so read APSB26-73 for the affected versions and fixes.
The vector needs high privileges over the network, with low complexity and a changed scope.
How to check if you're exposed
Read your installed version, then compare it with the fixed versions in Adobe bulletin APSB26-73.
bin/magento --version
composer show magento/product-community-edition
composer show magento/product-enterprise-edition
Use the package that matches your edition. Adobe Commerce B2B and I/O Events modules ship as separate packages, so check them with composer show as well.
What to do now
- Read APSB26-73 and note the fix for your release line.
- Apply it to staging, test the storefront and admin, then deploy to production.
- Review which people and integrations hold admin roles, and remove unused accounts.
- Turn on multi factor authentication for the admin panel if it is not already on.
Why it matters
The class is CWE-116, improper encoding or escaping of output. When an application writes data into a page, a command or another format, it must encode it for that context. If it does not, data can be read as instructions.
The high privilege requirement narrows who can trigger it, but store admin accounts are common targets, and one of them is enough. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
Paste your lockfile or manifest into the free in-browser dependency scan to see whether the Adobe Commerce or Magento packages is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.
Quick check
Why patch if only admins can trigger it?
Admin credentials get phished and reused. A flaw that turns an admin session into code execution raises the cost of that compromise.
Sources
Last reviewed: 19 October 2026.
