Adobe Commerce and Magento CVE-2026-48356 (PolyShell) Added to CISA KEV: Apply APSB26-73 and Check for Planted Files

On 27 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356, a file upload flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities (KEV) catalog. US federal agencies must remediate it by 10 November 2026 (CISA KEV). Adobe rates the flaw Critical and fixed it on 14 July 2026 in security bulletin APSB26-73 (Adobe APSB26-73).

This is not a new, unpatched flaw. Fixes have been available for more than three months. What changed is that CISA now lists it as exploited. Adobe's own scoring says an attack needs user interaction, and CISA records the use of this flaw in ransomware campaigns as "Unknown". The main job for most store operators is to confirm the July fix is in place and then check that nothing was planted before it was applied.

Technical Information

What the flaw is. Adobe describes CVE-2026-48356 as an "Unrestricted Upload of File with Dangerous Type" (CWE-434) that "could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session." Per the same description, "exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page" (NVD).

How it is scored. Two Adobe scores are public, and both are Critical:

The only difference is the availability impact. Both vectors say no privileges are needed, user interaction is required and the scope is changed. The bulletin lists the impact as privilege escalation and says no authentication is required (Adobe APSB26-73; CVE record).

What the researcher who named it says. Sansec, an e-commerce security company, says it discovered the flaw and named it "PolyShell" (Sansec, 17 March 2026). Sansec describes it as a way to upload files through the store's REST API without logging in, with files disguised as images. Sansec says whether an uploaded file can then run as code depends on the store's web-server setup, and that the file stays on disk even when the server blocks it from running. Sansec's description is broader than Adobe's scoring; we report both and have not tested either.

Exploitation status. CISA lists CVE-2026-48356 in the KEV catalog. CISA's assessment attached to the NVD record marks exploitation as "active", automatable as "no" and technical impact as "total" (NVD). Adobe's bulletin, last updated 11 August 2026, still says Adobe "is not aware of any exploits in the wild" for the issues it fixes; that line predates CISA's listing. Sansec reports exploitation attempts from March 2026, before Adobe's production fix, and a large automated attack wave on 30 March 2026 in which attackers placed web shells and then injected JavaScript into store pages (Sansec, 30 March 2026). On 24 October 2026, Sansec linked PolyShell to a long-running campaign that loads attacker scripts from the stores' content blocks (Sansec, 24 October 2026). These are Sansec's findings; Adobe and CISA have not published victim details.

Timeline (dates as published by each source):

• 17 March 2026: Sansec publishes its PolyShell research and says no fix exists yet for production versions (Sansec).
• 30 March 2026: Sansec reports a large automated attack wave (Sansec).
• 14 July 2026: Adobe publishes APSB26-73 (Priority 2) and knowledge base article KA-37421 with isolated patches. The CVE record and the NVD entry are published the same day (Adobe KA-37421; NVD).
• 11 August 2026: Adobe last updates APSB26-73. KA-37421 follows on 20 August.
• 24 October 2026: Sansec ties PolyShell to the content-block loader campaign (Sansec).
• 27 October 2026: CISA adds CVE-2026-48356 to KEV, with a due date of 10 November 2026 (CISA KEV).
• 28 October 2026, 06:18 Cyprus time (UTC+2): NVD updates the record with the KEV details (NVD).

Affected Product Versions

Per Adobe's bulletin and the CVE record:

Notes:

• The July fix ships as isolated patches. Adobe says the July fixes for its release lines were published as isolated patch files, not Composer packages. Each patch applies only to the latest patch level of its line (2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 or 2.4.4-p18), so stores on an older patch level must first move to that level (Adobe KA-37421).
• Adobe Commerce on cloud infrastructure is covered by the latest cloud-patches update, per KA-37421.
• Magento Open Source downloads of the isolated patch are available for 2.4.6 and later only, per KA-37421.
• Stores on 2.4.9. Sansec's PolyShell page says the May 2026 release of 2.4.9 contained the fix, but Adobe's bulletin and the CVE record list 2.4.9 as affected and 2.4.9-2026-jul as fixed. Follow Adobe's list (Adobe APSB26-73).
• Exposure is not compromise. Running an affected version means a store needs the fix; it does not mean the store was breached.

Workaround and Mitigation

1. Apply APSB26-73. Move to the 2026-jul release for your line, or apply the matching isolated patch from KA-37421 after reaching the latest patch level. Update Adobe Commerce Events to 1.21.0 if you use it (Adobe APSB26-73).
2. Confirm the patch is really in place. Adobe's KA-37421 points to its Commerce Version Tool, which reports which monthly security patches are installed and which are missing, and to the Quality Patches Tool status check for cloud merchants (Adobe KA-37421).
3. Look for files planted before the patch. Sansec notes that patching does not remove files already uploaded. Its guidance is to check the upload directories under pub/media/custom_options/ for unexpected files and to search for the backdoor file names it lists (Sansec).
4. Block web access to the upload folder. Sansec recommends web-server rules that deny all access to pub/media/custom_options/. It also notes that this limits the damage but does not stop the upload itself (Sansec).
5. Check store content and admin accounts. Sansec advises searching CMS blocks and pages for injected scripts, reviewing admin accounts you do not recognise, and changing database, admin and API integration passwords after cleanup (Sansec).
6. US federal agencies must follow CISA's required action under BOD 26-04 by 10 November 2026 (CISA KEV).

Indicators of Compromise

Adobe and CISA have not published indicators of compromise for CVE-2026-48356. Sansec has published the following indicators from its own investigations, shown here defanged and attributed to Sansec (Sansec, March 2026; Sansec, 24 October 2026):

Sansec lists these domains for a script-loader campaign it has tracked since July 2025; two of them were in use before PolyShell was disclosed, so a match points to that campaign rather than proving this flaw was used. Sansec also lists more than 50 IP addresses it saw scanning for the flaw; see its PolyShell page. No source we checked maps this flaw to MITRE ATT&CK techniques, and we have not done so.

What we will update

We will update this post if Adobe revises APSB26-73 or comments on exploitation, if CISA changes the KEV entry or its ransomware field, if Adobe and NVD align their CVSS scores, or if a national CERT publishes guidance.

Sources

• Adobe: Security bulletin APSB26-73, "Security update available for Adobe Commerce" (14 July 2026, last updated 11 August 2026): https://helpx.adobe.com/security/products/magento/apsb26-73.html (also at https://www.adobe.com/trust/security/products/commerce/apsb26-73.html); knowledge base article KA-37421 (last updated 20 August 2026): https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421
• CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-48356 (added 27 October 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356
• NVD and CVE Program: https://nvd.nist.gov/vuln/detail/CVE-2026-48356; https://www.cve.org/CVERecord?id=CVE-2026-48356
• Sansec (researcher; the second and third pages are linked from the NVD record): "PolyShell: unrestricted file upload in Magento and Adobe Commerce" (17 March 2026): https://sansec.io/research/magento-polyshell; report on the PolyShell mass attack wave (30 March 2026): https://sansec.io/research/polyshell-mass-attack-wave; report on the deepveindrilling.com Magento CMS block loader (24 October 2026): https://sansec.io/research/magento-cms-block-loader-deepveindrilling

Why this matters for your vendors

Many companies rely on agencies, marketplaces and partners that run Adobe Commerce or Magento storefronts for them, and a store that was compromised before it was patched can keep the attacker's foothold after the patch. A supplier that can quickly confirm the July fix and show it checked for planted files is a supplier that knows its own platform.

Forward this to your TPRM owner: A short, friendly check for suppliers that run online stores for you (Rescana guidance):

• Do you run Adobe Commerce or Magento Open Source? Which release line and patch level?
• Is APSB26-73 applied, and does Adobe's Commerce Version Tool confirm it?
• Since March 2026, have you checked the upload folders, CMS content and admin accounts for anything you did not put there?

Want a fast, evidence-based view of how your suppliers handle fixes like this one? Book a demo.