CVE-2026-48356

Published Jul 14, 2026

Last updated a day ago

Exploit knownCVSS critical 9.3
Adobe Commerce
PolyShell

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-48356 is an unrestricted file upload vulnerability affecting Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Adobe I/O Events connector for Commerce. The flaw arises from insufficient validation of uploaded file types, allowing attackers to upload files without adequate restrictions on their extension or MIME classification. This enables attackers to place content on the system that a web server interprets as an executable script. Successful exploitation requires user interaction—such as a victim visiting a maliciously crafted URL or interacting with a compromised page—and can lead to arbitrary code execution in the context of the current user, potentially granting the attacker elevated access or control over the victim's session. Also known as "PolyShell," the vulnerability has been actively exploited in the wild, with activity traced back to at least July 2025. Security researchers have observed attackers leveraging the flaw to breach hundreds of e-commerce stores, injecting malicious loaders via Magento CMS blocks to fetch and execute attacker-controlled payloads. Due to this active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 to its Known Exploited Vulnerabilities (KEV) catalog in October 2026. Adobe addressed the issue in its July 2026 security updates (APSB26-73), and organizations are advised to apply the patches and inspect their systems for unauthorized file uploads.

Description
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Source
psirt@adobe.com
NVD status
Analyzed
Products
commerce, commerce_b2b, magento, i\/o_events

Risk scores

CVSS 3.1

Type
Primary
Base score
9.3
Impact score
5.8
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Exploit added on
Oct 27, 2026
Exploit action due
Nov 10, 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

psirt@adobe.com
CWE-434

Social media

Hype score
Not currently trending
  1. CISA metió el martes 27 oct CVE-2026-48356, una subida de archivos peligrosos en Adobe Commerce y Magento, en su catálogo de fallas explotadas, con plazo del 10 nov para agencias federales de EE. UU. Sansec dice que con ella ya vulneraron cientos de tiendas en línea. Lo que

    @jfernandogg

    28 Oct 2026

    58 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Attackers exploited CVE-2026-48356 to inject malicious loaders into Magento CMS blocks across 953+ e-commerce stores — persistent since at least July 2025. Simultaneously, live Node2Shell exploit traffic emerged targeting Brotli decoders across Node.js, PHP, and Envoy, with 91%

    @aviatrixtrc

    28 Oct 2026

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CISA added CVE-2026-48356 in Adobe Commerce and Magento and CVE-2026-111497 in Google Brotli to its KEV Catalog based on evidence of active exploitation, urging organizations to prioritize remediation. https://t.co/ENlkBm9kNd

    @TweetThreatNews

    28 Oct 2026

    204 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CISA KEV adds 2 actively exploited bugs: CVE-2026-48356 "PolyShell" in Magento/Adobe Commerce (hundreds of stores breached) + CVE-2026-111497 "Node2Shell" in Brotli, with live exploit traffic hitting Node.js. Patch Magento, upgrade Node & PHP now. #magent… https://t.co/Q9Hr

    @DEVOTOMSOLUTION

    28 Oct 2026

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🔒 #CyberSecurity CISA KEV Alert: CVE-2026-48356 (Adobe Commerce/Magento File Upload) and CVE-202… "On October 27, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities…" 🔗 https://t.co/tSJVZ9kknG #CyberSecurity #ThreatIntel #cve #zeroday

    @SecurityAr58409

    28 Oct 2026

    59 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CISA added CVE-2026-111497 (Brotli) and CVE-2026-48356 (Adobe Commerce) to KEV. Exploit traffic for Node2Shell was observed from 94.154.43[.]7 while Magento stores face active PolyShell loader injections https://t.co/XJw8Tbnwlj https://t.co/QC14eBVf0C

    @2Workly

    28 Oct 2026

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CISA's KEV catalog (Oct 27) adds Google Brotli CVE-2026-111497 and Adobe Commerce/Magento CVE-2026-48356, with a Nov 10 federal due date. Both PHP2Shell CVEs remain listed since Oct 26. https://t.co/OCPxg0n78u

    @InfraWatchHQ

    27 Oct 2026

    83 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. CVE-2026-48356 · Exploração conhecida (KEV da CISA) · CVSS 9,3 (Crítica) CISA inclui falha de upload de arquivo no Adobe Commerce e Magento em lista de exploradas #KEV #CVE

    @breachbriefing

    27 Oct 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. CISA, Brotli (CVE-2026-111497) ve Adobe Commerce/Magento (CVE-2026-48356) açıklarını aktif istismar kanıtıyla KEV kataloğuna ekledi; Brotli'yi 1.0.10 / 1.1.1 / 1.2.1'e, Adobe Commerce/Magento'yu Temmuz 2026 güvenlik sürümüne güncelleyin. https://t.co/pKxbuU4BDW https

    @siberguvenlikhb

    27 Oct 2026

    73 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. CISA ha incorporado al catálogo KEV dos vulnerabilidades con explotación activa: CVE-2026-48356 en Adobe Commerce/Magento y CVE-2026-111497 en Google Brotli. https://t.co/cmJfo5mgqN

    @Root__Void

    27 Oct 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. 【KEV追加】Adobe Commerce/MagentoのCVE-2026-48356(CVSS 9.3)が悪用確認。2.4.9以前は2.4.x-2026-jul以降へ更新を。 CISA KEV: Adobe Commerce/Magento CVE-2026-48356 (CVSS 9.3) exploited. Update to 2.4.x-2026-jul or later. https://t.co/2oencH57tr

    @ZeroKaiLabs

    27 Oct 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. 🛡️We added Adobe Commerce vulnerability CVE-2026-48356 & Google Brotli vulnerability CVE-2026-111497 to our KEV Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org. #Cybersecurity #InfoSec https://t.co/dabXDiqV2x

    @CISACyber

    27 Oct 2026

    9157 Impressions

    15 Retweets

    62 Likes

    8 Bookmarks

    7 Replies

    5 Quotes

  13. 🦠 953 e-commerce sites, mostly Magento, are running a persistent malicious JavaScript loader injected into their CMS blocks. 📌 What happened: an unknown threat actor got in through PolyShell (CVE-2026-48356, CVSS 9.3), SessionReaper (CVE-2025-54236, CVSS 9.1) and rogue adm

    @BadgerSignalHQ

    27 Oct 2026

    64 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. 953 online stores compromised, mostly running Magento. The campaign exploited PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) to gain access, then injected JavaScript loaders designed to evade security scanners. One case involved a rogue admin account despite

    @itsMikeKipruto

    27 Oct 2026

    413 Impressions

    2 Retweets

    7 Likes

    5 Bookmarks

    0 Replies

    0 Quotes

  15. 🟠 High · Partly patched Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper CVE-2026-48356, CVE-2025-54236 https://t.co/YhACulOfuF

    @pwnwatch_app

    26 Oct 2026

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. A double-whammy on Adobe Magento! CVE-2026-75650 - Adobe Magento - Critical 10.0 - Unauthenticated Remote Code Execution https://t.co/FBmDJ4OCKJ CVE-2026-48356 - Magento - Critical 9.3 - Unauthenticated Unrestricted File Upload https://t.co/VSHOcO4AqN https://t.co/yjkrCzz7Xc

    @abraxas_null

    26 Sept 2026

    76 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  17. Adobeの定例更新。CVE96件が修正。Acrobatは無風。ColdFusionでCVSSスコア9.9のパストラバーサルCVE-2026-48318。CommerceでCVSSスコア9.6の権限昇格CVE-2026-48356。Adobe Experience ManagerでCVSSスコア9.6の任意コード実行CVE-2026-48259及

    @__kokumoto

    14 Jul 2026

    1163 Impressions

    1 Retweet

    6 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

Configurations