Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

CISA on Tuesday added the Adobe Commerce and Magento vulnerability CVE-2026-48356 (CVSS 9.3), known as PolyShell, to its Known Exploited Vulnerabilities catalog, citing active exploitation. Sansec says attackers have used the unrestricted file-upload flaw to breach hundreds of e-commerce stores since at least July 2025, injecting a malicious loader through a Magento CMS block; federal agencies have until November 10, 2026 to apply the fixes.