CISA flags actively exploited Adobe Commerce 'PolyShell' flaw as Sansec reports hundreds of breached stores

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Adobe Commerce and Magento vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after researchers tied it to a wave of store breaches, The Hacker News and BleepingComputer reported on October 28, 2026. The flaw, tracked as CVE-2026-48356 and nicknamed "PolyShell," was added to KEV on October 27 alongside a separate Brotli decoder bug, with CISA citing evidence of active exploitation for both.

What happened

According to The Hacker News, PolyShell is an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento, carrying a CVSS score of 9.3. The report says it can lead to arbitrary code execution in the current user's context, potentially giving an attacker elevated access to a victim's account or session. By adding the flaw to the KEV catalog, CISA set a November 10, 2026 patch deadline for U.S. federal civilian agencies and signaled that it has evidence the bug is being used in real attacks.

Technical details

The Hacker News cites Sansec, which reported that attackers used PolyShell to breach hundreds of e-commerce stores. According to Sansec, the attackers injected a malicious loader through a Magento CMS block; the loader then fetched and executed an attacker-controlled payload. The report notes that no next-stage malware has been recovered, so the campaign's ultimate goal remains unclear, and that the activity is assessed to have been ongoing since at least July 2025. The Hacker News adds that while the article body refers to "hundreds" of stores, a linked Sansec report points to a figure of 953 affected stores, which it says should be treated as unverified.

Who is affected

The flaw affects merchants running Adobe Commerce and Magento storefronts, a platform widely used across online retail. Because the attack works by planting code through a CMS block, compromised sites risk both backend takeover and downstream harm to shoppers if the injected payload is later used for skimming or other malicious purposes.

What to do

The reporting does not detail a specific Adobe patch build for CVE-2026-48356, so merchants should consult Adobe's security advisory and apply the vendor's fix for the flaw as a priority. CISA urges all network defenders, not only federal agencies, to prioritize KEV-listed bugs. Store operators are advised to inspect Magento CMS blocks for unauthorized or unexpected code, review admin and file-upload activity for signs of compromise, and monitor for malicious loaders consistent with the Sansec findings.