CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

CISA says it has added two new vulnerabilities to its KEV Catalog, based on evidence of active exploitation[2]. One of them is CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability[2].SecurityOnline reports that the flaw carries a CVSS score of 9.3 and that federal agencies must patch by November 10, 2026[1].Adobe's CVE record, as mirrored by SentinelOne, says the flaw "could result in arbitrary code execution in the context of the current user"[3]. It also says exploitation requires user interaction[4]. HOL reports that Sansec saw 471 stores compromised in one hour via PolyShell webshells followed by injected JavaScript loaders[5].HOL notes that Adobe's APSB26-73 bulletin still states Adobe is not aware of exploits; exploitation evidence comes from Sansec's research[5]. HOL adds that on Adobe's sample nginx and Apache configs the uploaded file is not served[5].SecurityOnline reports that Adobe fixed the Magento flaw in July 2026 under bulletin APSB26-73[1]. It advises admins to install the matching 2026-jul patch for your release[1].HOL warns that patched stores may still hold files uploaded before patching[5]. SentinelOne recommends that administrators rotate administrative credentials and invalidate active admin sessions after patching[4].