Adobe Commerce — CVE-2026-48358 (Critical)

Date Jul 14, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Adobe · Commerce

CVE CVE-2026-48358

Critical vendor advisory CVE-2026-48358

Summary

Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.1) in Adobe Commerce. Patch or mitigate promptly. EPSS percentile: 56%.

Operator check

Review CVE-2026-48358 in your asset inventory. Apply patches per vendor guidance and verify Commerce is not exposed. CVSS score: 9.1. EPSS probability: 0.9%; percentile: 56%.

Sources

NVD — CVE-2026-48358 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed