2026-10-28
Adobe Commerce and Magento vulnerability CVE-2026-48356: CISA confirms exploitation (KEV), the July fix, and how to check for intrusion
On October 27, 2026, CISA added CVE-2026-48356, a file upload vulnerability in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities (KEV) catalog. The deadline for US federal civilian agencies is November 10. Adobe fixed this flaw, along with 13 others, in security bulletin APSB26-73 on July 14, 2026. Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.6 to 2.4.9, Adobe Commerce B2B and Adobe Commerce Events are affected. The fix is the 2026-jul security fix for each release line (1.21.0 for Events). Adobe's bulletin table rates it CVSS 9.6, while Adobe's CVE record and NVD rate it 9.3; the only difference is the availability impact. Adobe's bulletin (updated August 11) still says Adobe is not aware of exploitation. On October 24, an e-commerce security company reported that web shells placed through this flaw (which it calls PolyShell) and other flaws were used to inject JavaScript into store pages, in a campaign that has reached 953 stores, mostly Magento, since July 2025, and that it found the injected code on patched stores too. As of October 28, no Japanese public agency has issued an alert and no Japanese store has disclosed being affected. This site's conclusion: Adobe Commerce and Magento stores should confirm today that the July fix is applied, and even if it is, check upload folders, CMS blocks and admin accounts for signs of intrusion.