← CVE Radar
CVE-2026-48358Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
9.1 CRITICALEPSS 1.20%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.1 | CRITICAL | 3.1adobe (CNA) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-48358
- Status
- Analyzed
- Assigner (CNA)
- adobe
- Published
- Jul 14, 2026
- Last modified
- 2026-08-28 00:17 UTC
- Weaknesses
- CWE-116 · Improper Encoding or Escaping of Output (CWE-116)
Affected Products
As published by the CNA in the CVE record.
AdobeAdobe Commerce1 version range
- through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
AdobeAdobe Commerce B2B1 version range
- through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
AdobeMagento Open Source1 version range
- through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
AdobeAdobe Commerce Events1 version range
- through 1.20.0