CVE-2026-48358

Critical · CVSS 9.1

Adobe Commerce (Magento) — Improper Encoding or Escaping of Output leading to arbitrary code execution (CWE-116)

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-116

Description

Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Search profile — drives PoC discovery

Symbols CWE-116APSB26-73CVE-2026-48358improper encodingescaping outputarbitrary code executionscope changed

Keywords CVE-2026-48358Adobe Commerce exploitMagento CVE-2026-48358APSB26-73 PoCMagento improper escaping RCEAdobe Commerce CWE-116Magento output encoding bypassAdobe Commerce arbitrary code executionMagento APSB26-73 exploitMagento RCE 2026

Versions: <UNKNOWN>

References

https://helpx.adobe.com/security/products/magento/apsb26-73.html

Status: enriched · ingested 2026-07-15T18:00:20.000Z · profiled 2026-07-15T18:30:20.000Z