On October 27, 2026, CISA added CVE-2026-48356 - a critical Adobe Commerce and Magento flaw nicknamed PolyShell - to its Known Exploited Vulnerabilities catalog after confirming active exploitation. Security firm Sansec has tracked hundreds of breached online stores, most running Magento. If your store runs on either platform, verify this week that Adobe’s July 2026 patch is applied.
Quick answer: CISA’s October 27 alert adds CVE-2026-48356 - an unrestricted file-upload flaw in Adobe Commerce and Magento that researchers call PolyShell - to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. An attacker can use the shopping cart’s REST API, without logging in, to upload a file that can lead to code execution and full control of the store. The most important action: confirm your store is on Adobe’s July 2026 or later security release, then check for signs someone was already inside.
What happened?
On October 27, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog - the list reserved for flaws with confirmed real-world attacks. The one that matters here is CVE-2026-48356: an unrestricted file upload in Adobe Commerce and Magento Open Source, the platforms behind many small and mid-size online stores. Adobe rates it critical, with a CVSS base score of 9.6.
Security firm Sansec, which discovered the flaw and named it PolyShell, says attackers reach it through the guest cart’s REST API - the part of the store that handles cart items before checkout. No login is required, and the uploaded file can give the attacker code execution and, from there, control of the store. Sansec notes the GraphQL API path is not affected.
This is not theoretical. The Hacker News reported on October 26 that Sansec had documented 953 online stores infected with scanner-evading malicious JavaScript - most running Magento - and estimates 471 were breached through PolyShell. The injected code hides from security scanners, which is why store owners often notice nothing wrong.
The uncomfortable detail: Adobe has had a patch available since July 14, 2026 (bulletin APSB26-73). The breached stores were, by and large, simply missing core patches. CISA’s catalog entry sets a November 10, 2026 remediation date for federal agencies and encourages all organizations to prioritize KEV vulnerabilities.
The same alert added CVE-2026-111497, a flaw in Google’s Brotli compression library embedded in Node.js and many .NET applications. Google shipped a fix in Brotli 1.2.1 on October 21, with Node.js and Microsoft following.
Why does this matter for small businesses?
For Pennsylvania small businesses and nonprofits, three parts of this story matter.
Online stores get breached through old, patchable flaws. The fix for PolyShell has been available since July 2026. The stores in Sansec’s research were breached months after it shipped, because nobody applied it. The most common pattern in small-business web security isn’t a sophisticated zero-day - it’s a known bug and a missed update.
The victim profile is small retail, not enterprise. Magento Open Source is free to use, which is why it powers many independent shops - retailers and nonprofit online stores that don’t have someone reading Adobe’s security bulletins. Attackers count on that gap.
A compromised store is a trust problem. When malicious JavaScript runs on your checkout pages, someone else controls what your customers see and type. And patching closes the door without evicting anyone already inside - CISA’s directive for federal agencies explicitly requires checking whether a system was compromised before the patch was applied.
What should you do this week?
-
Find out what your online store runs. Ask whoever maintains it: “Are we on Magento or Adobe Commerce, and what patch level?” If you’re on another platform, this flaw doesn’t apply - but you should still know the answer.
-
If you’re on Magento or Adobe Commerce, confirm the July 2026 security release is applied. Adobe’s bulletin APSB26-73 (July 14, 2026) carries the fix for supported versions. If the store hasn’t been updated since July, treat it as urgent - attacks are happening now.
-
After patching, look for signs of prior compromise. Check for administrator accounts nobody recognizes, unfamiliar files in upload directories, and scripts injected into checkout pages or CMS blocks. If you’re not sure what “normal” looks like, this is a good task for your IT partner.
-
If you run custom web applications, ask your developer about the Brotli flaw. CVE-2026-111497 sits in a library embedded in Node.js and many .NET applications; your developer should confirm your app’s dependencies and apply the vendor updates.
-
Put the store on a patch schedule. The pattern here - breached months after a patch existed - is preventable with routine maintenance, not heroics.
Frequently asked questions
My online store runs Magento or Adobe Commerce. How do I know if it’s affected? Adobe’s bulletin lists the affected versions: Adobe Commerce 2.4.4 through the 2.4.9 line and Magento Open Source 2.4.6 through 2.4.9, at patch levels before the July 2026 security releases. If your store hasn’t been updated since July, treat it as affected and patch.
What is PolyShell, and what can an attacker do with it? PolyShell is the name security firm Sansec gave CVE-2026-48356, an unrestricted file-upload flaw in Adobe Commerce and Magento. An unauthenticated attacker can upload a dangerous file through the guest cart’s REST API, which can lead to code execution and full compromise of the store.
Does the November 10, 2026 deadline apply to my business? No. That date is a compliance deadline for federal civilian agencies under CISA’s BOD 26-04 directive. CISA encourages all organizations to prioritize KEV catalog vulnerabilities, so treat November 10 as a sensible benchmark - and don’t wait for it if your store is unpatched today.
We don’t run Magento or Adobe Commerce. Does this alert affect us? The same alert added CVE-2026-111497, a flaw in Google’s Brotli library embedded in Node.js and many .NET applications - relevant if you run custom web applications. Beyond that, the lesson applies to any e-commerce platform: confirm someone is applying security updates, because attackers consistently breach stores through months-old, already-patched flaws.
If I patch today, is my store safe? Patching closes the door, but it doesn’t evict anyone who already walked through it. After patching, check for unfamiliar administrator accounts, files you don’t recognize, and scripts injected into your checkout pages. Sansec found the malicious code was built to evade scanners, so a clean bill of health requires actually looking.
Where does Merit IT fit in?
Keeping an online store secure is mostly unglamorous maintenance: patches applied on schedule, someone watching for injected code, and a plan for the week a platform has a bad month. That’s the core of our IT support practice - patching, monitoring, and backup and disaster recovery for small businesses and nonprofits across Pennsylvania, month-to-month with no long-term contract. And when a business runs custom web applications, our software development team treats dependency updates - like the Brotli fixes in this alert - as part of shipping software responsibly.
Get a free technology assessment - we’ll review your website and application patch status and your overall security posture, and give you a clear picture with no obligation. Or keep reading on the Merit IT blog for more practical, no-hype IT guidance.