CVE-2026-48358
CRITICALDescription
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Is your site exposed to CVE-2026-48358?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | commerce_b2b |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | magento |
| adobe | i\/o_events |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2026-48358? +
How severe is CVE-2026-48358? +
What products are affected by CVE-2026-48358? +
How do I check if I'm vulnerable to CVE-2026-48358? +
Related Vulnerabilities
GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a …
HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions …
Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. …
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName …
Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to …
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the …