CISA adds Adobe CVE-2026-48356 to KEV after July advisories
Original title: Adobe security advisory (AV26-697) – Update 1
Canada’s Cyber Centre points admins to July Adobe fixes covering After Effects, ColdFusion, AEM and other products.
On October 27, 2026, the Canadian Centre for Cyber Security updated advisory AV26-697 after CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities catalog. Adobe’s July 14, 2026 advisories addressed critical vulnerabilities in many products, including After Effects, Animate, Audition, Bridge, Commerce, Experience Manager, ColdFusion, Premiere, Illustrator and Creative Cloud Desktop. The Cyber Centre urges users and administrators to review Adobe’s advisories and apply the necessary updates. The notice does not name the product affected by CVE-2026-48356.
Unconfirmed: The notice does not identify which Adobe product CVE-2026-48356 affects or say the other listed flaws are exploited.
- Update 1 was issued on October 27, 2026; the original notice is dated July 14, 2026.
- ColdFusion 2025 Update 10 and earlier, and 2023 Update 21 and earlier, are listed.
- AEM Cloud Service Release 2026.5.0 and prior and AEM 6.5 Service Pack 24 and prior are included.
- Only CVE-2026-48356 is named as added to CISA’s KEV catalog.
Impact: Critical Adobe flaws; one CVE is known exploited
| Product | Affected |
|---|---|
| Adobe After Effects | 25.6.5 and prior; 26.2.1 and prior |
| Adobe Animate | 2023 version 23.0.15 and prior; 2024 version 24.0.13 and prior |
| Adobe Audition | 25.6.4 and prior; 26.0 and prior |
| Adobe Bridge | 15.1.5 (LTS) and prior; 16.0.3 and prior |
| Adobe Commerce and Commerce B2B | multiple versions |
| Adobe Commerce Events | 1.6.0 to 1.20.0 |
| Adobe Experience Manager | AEM Cloud Service Release 2026.5.0 and prior; 6.5 LTS Service Pack 1 and prior; 6.5 Service Pack 24 and prior |
| Adobe ColdFusion | 2025 Update 10 and earlier; 2023 Update 21 and earlier; 2021 version 2021.0.0.323925 and prior; 2023 version 2023.0.0.330468 and prior; 2025 version 2023.0.0.331385 and prior |
| Adobe Creative Cloud Desktop Application | 6.9.1.1 and prior |
| Adobe Illustrator | 2025 version 29.8.7 and prior; 2026 version 30.5 and prior |
- 1.Review the linked Adobe security advisories and apply the necessary updates.
- 2.Prioritize CVE-2026-48356 because CISA added it to the KEV catalog.
- CVEs
- CVE-2026-48356
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26–697 Date: July 14, 2026 Updated: October 27, 2026 On July 14, 2026, Adobe published security advisories to address critical vulnerabilities in the following products: Adobe After Effects - version 25. 6. 5 and prior Adobe After Effects - version 26.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.