CISA Adds Exploited Adobe Commerce and Magento Flaw to KEV

CISA added CVE-2026-48356, an unrestricted file-upload flaw (CWE-434) in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities (KEV) catalog on Oct 27, citing evidence of active exploitation. Federal civilian agencies must apply Adobe's mitigations by Nov 10; that deadline binds federal civilian agencies only. CISA lists whether the flaw has been used in ransomware campaigns as unknown.

Affected products. The flaw affects Adobe Commerce, Adobe Commerce B2B, Magento Open Source and Adobe Commerce Events. CISA says it could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as a victim visiting a maliciously crafted URL. Adobe rates the flaw 9.6 (critical) on the CVSS scale, while the NVD record shows 9.3.

Patch has been available. Adobe fixed the bug in security bulletin APSB26-73 on July 14, 2026. Adobe's bulletin still says it is not aware of exploits in the wild; CISA does not say who observed the exploitation.

Attack reports. Security firm Sansec says a March 2026 mass attack on Magento stores used what it calls "PolyShell", which it links to CVE-2026-48356, to upload webshells. That link and Sansec's attack counts are the firm's own claims, not CISA's.

Sources: CISA Known Exploited Vulnerabilities Catalog; CISA alert, Oct 27; NVD; Adobe APSB26-73; Sansec.