Search: CVE-2026-48356

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

A criminal group has compromised 953 online stores, mainly Magento shops, by injecting malicious JavaScript loaders into CMS blocks since July 2025. The latest domain used, deepveindrilling.com, employs advanced bot detection via browser fingerprinting to evade scanners. The malicious loader persists by storing code in visitors' localStorage. Attackers exploited known Magento vulnerabilities, including PolyShell and SessionReaper file upload flaws, to gain access. The campaign targets cryptocurrency users with fake Ledger wallet pages. Many stores were reinfected through persistent database access and backdoors, indicating long-term attacker presence despite cleanup efforts.