CISA Adds PolyShell in Magento to Actively Exploited Vulnerabilities

PolyShell in Magento, a critical vulnerability tracked as CVE-2026-48356, was added to the U.S. agency CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026. The listing means CISA has evidence that the flaw is being exploited in practice. It affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.

Adobe fixed the flaw on July 14, 2026, in security bulletin APSB26-73. Operators who have not yet deployed the fixed July builds for their supported product branch should prioritize the update.

PolyShell in Magento Enables Dangerous Uploads

Adobe classifies CVE-2026-48356 as a critical CWE-434 vulnerability, meaning a problem involving the upload of a dangerous file type. The vulnerability has a CVSS score of 9.6. It does not require authentication, but according to the vendor, it does require user interaction. Adobe lists the impact category as privilege escalation.

Researchers at Sansec gave the flaw the name PolyShell. According to their analysis, the issue involves file uploads through the REST API, and they observed attacks as early as March 2026. The possibility of fully remote code execution also depends on the web server configuration; inclusion in KEV alone does not establish the exact method of a successful attack in a specific environment.

In its July bulletin, Adobe said it was not aware of exploitation of the flaw in practice. CISA’s October 27 entry supersedes that status because it confirms the existence of exploitation. CISA has not disclosed technical details of specific attacks, the scope of affected stores, or indicators of compromise.

Fixes Have Been Available Since July

Adobe included fixes in the July builds for supported branches of Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. Operators should verify the version in use and compare it with the fixed versions listed in APSB26-73. For internet-accessible online stores, it is important not to delay deployment of the update simply because no attack has been recorded in their environment.

Sansec also recommends checking upload directories for suspicious files. This is a practical step especially for organizations that had a vulnerable version deployed during the period of observed attacks. Without public indicators of compromise, however, such a check alone does not provide a complete picture of a possible breach.

Why the Flaw Matters for Online Stores

Adobe Commerce and Magento Open Source are platforms deployed on publicly accessible online stores that may process customer and payment data. A flaw in the upload mechanism could allow an attacker to insert malicious content. Depending on the configuration, this could subsequently lead to takeover of an account, session, or server environment.

The key point is that this is not merely a theoretically assessed vulnerability. The KEV catalog is intended for flaws that CISA has recorded as being exploited in practice. Operators of unpatched installations should therefore assess the state of files uploaded to the system and their own security logs alongside applying the update.

What to Watch Next

Further information may come from CISA, Adobe, or other trusted authorities if they publish indicators of compromise or campaign details. The scope of the attacks and the number of affected stores have not yet been publicly confirmed. Any incident or breach confirmations directly linked to CVE-2026-48356 would also be relevant.

Verified and updated: 10/28/2026 06:19