PolyShell Attacks Breach Hundreds of Stores; CISA Confirms Active Exploitation
Attacks dubbed PolyShell exploit CVE-2026-48356, an unrestricted upload of a dangerous file type flaw in Adobe Commerce and Magento, and have breached hundreds of stores, according to The Hacker News. CISA added the flaw to the KEV catalog on October 27, 2026, citing active exploitation, with a federal deadline of November 10, 2026. Adobe already fixed it in the July 2026 updates (APSB26-73); apply the patch and hunt for webshells and injected CMS blocks.
What happened
Attacks dubbed PolyShell exploit a file upload flaw in Adobe Commerce and Magento (CVE-2026-48356) and have breached hundreds of stores, according to The Hacker News. CISA confirmed active exploitation by adding the flaw to the KEV catalog on October 27, 2026, with a federal deadline of November 10, 2026. Adobe fixed the flaw in its July 2026 updates (APSB26-73).
Why it matters
The flaw allows arbitrary code execution and elevated access or control over the victim's account or session, without authentication, according to CISA and DailyDarkWeb. Any Adobe Commerce or Magento store missing the July 2026 patches is exposed to breach. Ransomware use is listed as unknown by CISA.
What to do
Update immediately with Adobe's July 2026 updates (APSB26-73). After patching, hunt for webshells and injected CMS blocks, as DailyDarkWeb recommends. Follow vendor mitigations, BOD 26-04 and the forensics triage required by CISA.
For the technical team
- CVE
- CVE-2026-48356
- Affected
- Adobe Commerce e Magento · Adobe Commerce and Magento. CVSS 9.6 for CVE-2026-48356, according to DailyDarkWeb.
- Exploitation
- Active exploitation confirmed by CISA; the flaw entered KEV on October 27, 2026, with a federal deadline of November 10, 2026. PolyShell attacks breached hundreds of stores, according to The Hacker News. Ransomware use: unknown, according to CISA.
- Fix
- Adobe July 2026 updates (APSB26-73), according to DailyDarkWeb. CISA requires applying mitigations per vendor instructions, following BOD 26-04 and the Forensics Triage Requirements, or discontinuing the product if mitigations are unavailable.
- Vector
- Component: Adobe Commerce and Magento. Flaw: unrestricted upload of file with dangerous type (CVE-2026-48356), exploitable without authentication, according to DailyDarkWeb. Result: arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session, according to CISA.
- More details
- The flaw is known as PolyShell. In the same October 27, 2026 announcement, CISA also added CVE-2026-111497 (Google Brotli, CVSS 9.2) to KEV, an unchecked return value in the decoder that can corrupt memory and may allow remote code execution via a crafted compressed stream, fixed in Brotli 1.2.1 and Node.js 26.12.1, 24.22.1 and 22.23.4, according to DailyDarkWeb. CISA lists the Brotli flaw as exploited, although Node.js reported no exploitation on October 22, according to DailyDarkWeb. For Brotli, DailyDarkWeb recommends checking vendor advisories, container images and embedded runtimes, not just Node.js. For Magento stores behind the July patches, patch and then hunt for webshells and injected CMS blocks.
Timeline
CISA added CVE-2026-48356 to the KEV catalog on Oct 27 with a Nov 10 federal deadline; Adobe already fixed the flaw in its July 2026 updates (APSB26-73).
Report details PolyShell attacks that breached hundreds of stores after the flaw was added to KEV.
CISA added the flaw to the KEV catalog with a November 10, 2026 federal deadline.
Sources 3 sources
- CVE-2026-48356: Adobe Commerce and Magento (Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability) CISA KEV
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges The Hacker News
- @DailyDarkWeb @DailyDarkWeb
