CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
86
CVE-2026-48356
Unrestricted dangerous file upload in Adobe Commerce and Magento
CISA: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
- CVSS 3.1
- 9.3 critical
- EPSS
- 45%p99
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
Adobe Commerce, Commerce B2B, Magento, and I/O Events allow upload of a dangerous file type. A remote attacker needs no privileges but must lure a victim to a crafted URL or compromised page. Successful use can run code as the current user and take over that account or session, with impact beyond the original component. Adobe has not listed affected builds.
What to do: Apply Adobe’s update or mitigations for CVE-2026-48356. If mitigations are unavailable, discontinue use per CISA BOD 26-04.
| Product | Affected |
|---|---|
| Adobe Commerce | — |
| Adobe Commerce B2B | — |
| Adobe Magento | — |
| Adobe I/O Events | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
KEVCISA Known Exploited Vulnerability
- Affected
- Adobe Commerce and Magento
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- adobe
- Products
- commerce, commerce b2b, magento, i\/o events
- Ecosystems
- E-commerce
- Weakness
- CWE-434
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
In the news
12 storiesCISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
86
CISA adds exploited Adobe Commerce and Magento upload flaw to KEV
CVE-2026-48356 can run code as the current user; federal agencies must mitigate by November 10.
78
CISA adds Adobe Commerce and Google Brotli flaws to KEV
CVE-2026-48356 is an unrestricted upload flaw; CVE-2026-111497 is an unchecked return value bug in Brotli.
76
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
76
CISA adds Adobe CVE-2026-48356 to KEV after July advisories
Canada’s Cyber Centre points admins to July Adobe fixes covering After Effects, ColdFusion, AEM and other products.
74
953 online stores infected with Magento JavaScript loaders since July 2025
Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.
74
deepveindrilling.com Magento loader found on 83 stores
Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.
74
Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
72
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
72
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
72
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws
60