CISA lists Adobe Commerce’s PolyShell flaw as exploited, three months after the fix

On October 27, 2026, CISA added CVE-2026-48356, a file-upload flaw in Adobe Commerce and Magento Open Source, to its KEV catalog even though Adobe patched it on July 14. Applying the fix is not enough: you must hunt for the files and backdoors planted during the seven months the flaw stayed open.