Exploited Adobe Commerce File-Upload Flaw Enables Remote Code Execution

CSIRT Panamá warned that CVE-2026-48356, a critical unrestricted dangerous-file-upload vulnerability, affects Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe I/O Events. The advisory assigns a CVSS 3.1 score of 9.3 and says exploitation can execute arbitrary code in the current user’s context after a victim visits a crafted URL or interacts with a compromised page. Both CSIRT Panamá and Guyana’s national CIRT report that CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 27, confirming exploitation in the wild.

CSIRT Panamá cites mass-exploitation activity documented by Sansec, which separately reported a PolyShell attack wave hitting 214 stores in one hour; the supplied Sansec reference does not establish that those attacks exploited this specific CVE. Organizations should apply the applicable fixes in Adobe bulletin APSB26-73, upgrade Adobe I/O Events to version 1.21.0 or later, and investigate potentially affected systems for compromise. CSIRT Panamá cautions that patching alone does not remove attacker access already established, making incident investigation essential alongside remediation.