Adobe Under Active Attack, Microsoft Authenticator Fixed: UK SMB Cyber Brief 28th October 2026
CISA added Adobe Commerce and Magento to its Known Exploited Vulnerabilities catalogue on the 27th of October 2026. That catalogue is not a theoretical risk register. It is a list of vulnerabilities confirmed to be under active exploitation in the real world, right now. If you run either platform, you have a problem that requires action today.
This week’s brief covers the two stories with the most direct relevance to UK small businesses: the Adobe Commerce and Magento exploitation, and a patched flaw in Microsoft Authenticator for Android that deserves more attention than it has received.
Adobe Commerce and Magento: Active Exploitation Confirmed
CVE-2026-48356 is an unrestricted file upload vulnerability in Adobe Commerce and Magento. The flaw allows an attacker to upload a file of a dangerous type to the server, which the application then executes. The result is arbitrary code execution: the attacker runs code on your server in the context of the current user, potentially gaining elevated access or full control over the session and account.
CISA’s required action is unambiguous: apply mitigations in accordance with vendor instructions, or discontinue use of the product if mitigations are unavailable.
The business translation is straightforward. If you run an online shop on Magento or Adobe Commerce, and you have not applied the patch, your shop is a candidate for compromise. Attackers are not scanning for this vulnerability speculatively; CISA’s inclusion in the KEV catalogue confirms exploitation is occurring.
For UK small businesses, this matters beyond the obvious. Many SMBs use Magento or Adobe Commerce as their primary revenue channel. A compromised shop does not just mean downtime. It means customer payment data is at risk. It means a potential ICO notification obligation under UK GDPR. It means reputational damage that, for a business with 10 to 50 customers who chose you on trust, can be terminal.
The fix is available. Adobe has issued guidance. Apply it.
What the Adobe Campaign Classic Cluster Tells You
Separate from the KEV entry, NIST published a cluster of critical vulnerabilities in Adobe Campaign Classic on the 27th of October 2026. These include CVE-2026-105781 at CVSS 10.0, CVE-2026-104351 and CVE-2026-104353 both at CVSS 9.9, and several additional SQL injection and code injection flaws ranging from CVSS 9.1 to 9.9.
Adobe Campaign Classic is an enterprise marketing automation platform. It is not typical SMB software. However, the pattern matters: Adobe is having a bad patch cycle. Their products across the board are presenting critical-severity vulnerabilities simultaneously.
If your MSP or IT provider manages any Adobe products in your environment, this is a reasonable week to ask them directly: which Adobe products do we run, what patches are outstanding, and when will they be applied? That is not an aggressive question. It is basic due diligence.
Adobe Connect also received a CVSS 9.6 code injection vulnerability (CVE-2026-48360) in the same batch. Adobe Connect is used for webinars and remote meetings, which puts it within reach of many SMBs using Adobe’s broader product suite.
Microsoft Authenticator for Android: The Token-Theft Flaw
CVE-2026-80097 is a flaw in the Microsoft Authenticator app for Android. The vulnerability allowed a malicious application installed on the same device to impersonate a trusted Microsoft application, specifically Teams, and collect sign-in tokens for the victim’s work account. The critical detail: the malicious app required no permissions to do this.
Microsoft has fixed the flaw. The fix is in the updated version of the Authenticator app.
The reason this matters to UK small businesses is the specific threat model it represents. Many SMBs have deployed Microsoft Authenticator as their MFA solution, correctly, because MFA is one of the most effective controls available. This vulnerability did not defeat MFA in the traditional sense. It targeted the application that delivers MFA. An attacker who could get a malicious app onto an employee’s Android device could harvest work account tokens without the employee seeing any unusual authentication prompt.
The attack surface here is the employee’s personal Android device, if they use it for work. Bring-your-own-device arrangements, common in SMBs that do not issue company phones, create exactly this exposure. A malicious app downloaded from outside the Play Store, or a sideloaded application, could have exploited this.
The fix is available. Update Microsoft Authenticator on every Android device used to authenticate to work systems. If your employees use personal Android phones for MFA, this update needs to reach their personal devices too. That requires a conversation, not just an IT ticket.
The Pattern Behind This Week’s Data
Two different vendors. Two different product categories. One consistent theme: the tools people trust for commerce and authentication were themselves the attack surface.
This is not a novel observation, but the data keeps making it. Vendor trust is not a security control. The fact that a piece of software comes from a major vendor with a recognisable name does not mean it is free of exploitable flaws. What matters is whether you have a process for identifying when those flaws emerge and applying fixes before attackers use them.
For UK small businesses, that process does not need to be sophisticated. It needs to be consistent. CISA’s KEV catalogue is publicly available and free. Checking it weekly takes under five minutes. If a product you use appears on it, you have a confirmed active threat requiring immediate action. That is a more reliable signal than any vendor marketing email about “enterprise-grade security.”
How to Use This as a Competitive Differentiator
If your business handles customer data, processes payments, or provides services to larger organisations, your security posture is increasingly a commercial question, not just an operational one.
Larger clients and procurement teams are asking suppliers about patch management processes, incident response plans, and vulnerability tracking. Being able to demonstrate that you monitor CISA’s KEV catalogue, that you have a defined process for applying critical patches within 72 hours, and that you verify security tool updates across all employee devices: that is a concrete, verifiable answer to those questions.
It is also an honest answer, which distinguishes it from the compliance theatre that passes for security assurance in too many supplier questionnaires.
Making the Case Internally
If you need to make the case for faster patching or tighter mobile device management within your own business, the arguments this week are straightforward.
The regulator has an expectation. UK GDPR requires appropriate technical measures to protect personal data. An unpatched vulnerability on a known-exploited list is a difficult position to defend to the ICO after a breach.
The KEV catalogue removes ambiguity. You are not arguing about theoretical risk. You are pointing to a US government list confirming active exploitation. The risk is not hypothetical.
The cost of patching is predictable. The cost of a breach is not. A compromised Magento shop can mean customer payment data exposure, ICO investigation, and reputational damage. The patch takes an hour. The alternative takes months to recover from, if you recover at all.
MFA is still the right answer. The Authenticator flaw does not undermine the case for MFA. It reinforces the case for keeping security tools updated. One compromised MFA app, unpatched, creates a hole in an otherwise sound control. Keep the control; close the hole.
What to Do Before Friday
-
Patch Adobe Commerce or Magento immediately. Check which version you are running. Apply the update issued in response to CVE-2026-48356. If your shop is managed by a third party, contact them today and ask for written confirmation that the patch has been applied and when.
-
Update Microsoft Authenticator on all Android devices used for work. This includes personal devices used for MFA. If you cannot confirm this has happened, ask employees directly. A message in your team chat asking everyone to check their Authenticator version is a five-minute task.
-
Check CISA’s KEV catalogue against your software inventory. The catalogue is at cisa.gov/known-exploited-vulnerabilities-catalog. Cross-reference it against every application your business runs. If anything matches, treat it as urgent.
-
Ask your MSP or IT provider one specific question this week: which of the Adobe vulnerabilities published on the 27th of October 2026 affect our environment, and when will patches be applied? A provider who cannot answer that question within 24 hours is a provider you should be questioning more broadly.
-
Review your BYOD arrangements. If employees use personal Android devices for work authentication, you need a clear policy on app updates. Informally assuming employees keep their phones updated is not a security control. It is an assumption.
The data from this week is clear. Active exploitation is confirmed. Fixes are available. The only variable is whether you apply them.
Before you go: follow the show wherever you listen, and if it has been useful, leave a rating or a review. It takes thirty seconds and it genuinely helps. Drop a comment with your thoughts, particularly if you are running Magento or Adobe Commerce and have questions about the patching process. And if you know another small business owner who would find this useful, share it with them. The more people who act on this, the fewer easy targets there are.