Loading vulnerability…
Arbitrary Code Execution in Adobe Commerce Webhooks Output Encoding
CVE-2026-48358 is a critical improper encoding or escaping of output vulnerability in Adobe Commerce-related products, specifically noted as applying to webhooks functionality. The flaw affects Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin in affected versions prior to the July 2026 security update releases and prior to Webhooks Plugin version 1.21.0. Successful exploitation can result in arbitrary code execution in the context of the current user. The issue does not require user interaction, and exploitation requires high privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution in the context of the current user. Because scope is changed, exploitation may enable impact beyond the vulnerable component's original security boundary. Depending on the privileges of the compromised context, an attacker could execute application-level actions, alter data, and potentially leverage the foothold for further compromise of the affected commerce environment.
If you can’t patch tonight, do this now.
No separate vendor workaround or temporary mitigation was provided. Where immediate patching is not possible, reduce exposure by restricting access to administrative and high-privilege functions, limiting use and reachability of webhook-related functionality, enforcing least privilege for application and administrative accounts, and accelerating monitoring for suspicious activity in commerce administration and integration workflows until fixed versions are deployed.
Patch, then assume compromise.
Upgrade affected installations to the vendor-fixed releases. For Adobe Commerce, deploy the applicable July 2026 security update release for the installed branch. For Adobe Commerce B2B, deploy the corresponding July 2026 B2B update. For Magento Open Source, upgrade to the applicable July 2026 fixed release. For the Adobe Commerce Webhooks Plugin, upgrade to version 1.21.0. Apply the full Adobe security bulletin guidance for APSB26-73 across all affected components.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.