On October 27, CISA added CVE-2026-48356, affecting Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. It is an unrestricted upload of a file with a dangerous type, which is the plain-language version of an attacker putting their own code on your server. A second flaw was added the same day, CVE-2026-111497 in Google Brotli, an unchecked return value.
Most of the exploited-vulnerability news we cover involves appliances your IT provider owns. This one is different: Magento and Adobe Commerce are software a small business runs, and often one nobody has patched since it was installed.
Why file upload is the bad one
An unrestricted file upload flaw means the application accepts a file it should have rejected, and the server will later execute it. The result is attacker-controlled code running on the machine that processes your orders.
For a store, that has a specific and well-worn consequence: payment page skimming. Code gets injected into your checkout, it reads card details as customers type them, and it sends them elsewhere. Your store keeps working perfectly, orders keep arriving, and nothing looks wrong, which is exactly the design. Skimmers are built to be quiet because quiet is profitable.
Two things worth getting right
First, on the deadline. Several outlets report a November 10 remediation date. CISA's own alert does not state one, referring instead to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritise rapid remediation of high-risk KEV entries. The practical message for a business is unchanged, but it is worth knowing the date is not on the official notice.
Second, do not confuse this with SessionReaper. That is CVE-2025-54236, a 2025 Adobe Commerce flaw, and it is the one the widely repeated "250 stores compromised in 24 hours" figure belongs to. The two are being conflated in coverage this week. If you patched for SessionReaper, you are not covered for this.
What to actually do
- Find out your version today. If you cannot name it, that is the finding. Ask whoever built the store, and get the answer in writing.
- Apply Adobe's security update for the affected versions. If your store is on a customised build and updates have been deferred, this is the week that debt comes due.
- Look for a skimmer, do not assume. Compare your checkout page's scripts against what you expect, check for recently modified files, and look at outbound connections from the server. A clean-looking store is not evidence.
- Check the upload directories for files that should not be there, particularly anything executable in a folder meant for images.
- Rotate admin credentials and API keys if the store was exposed and unpatched. Patching does not undo access already taken.
- Name the owner. Most small-business stores have no one accountable for patching the platform, which is the actual root cause here rather than any single CVE.
- Keep the payment basics in view. The less card data touches your own infrastructure, the smaller a compromise like this becomes.
The takeaway
An e-commerce platform is a web application that handles money, and it needs the same patching discipline as anything else, which it very rarely gets because it is treated as a storefront rather than as software. This week there is a confirmed, actively exploited reason to find out what version you are on and who is responsible for it. Both answers are useful long after this particular flaw is fixed.