Today, 10 November 2026, is the deadline US federal agencies were given to patch a critical flaw in Adobe Commerce and Magento that attackers are already exploiting. Any online store still running unpatched software should treat the date as a final warning, not a routine reminder.

The flaw, tracked as CVE-2026-48356 and nicknamed PolyShell, is an unrestricted file-upload vulnerability in Adobe Commerce and Magento, the e-commerce platform behind thousands of online stores. It scores 9.3 out of 10 on the CVSS severity scale because it can let an attacker upload malicious files to a store's server and take control of it.

Why CISA set a deadline

On 27 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 to its Known Exploited Vulnerabilities catalogue, the list of flaws that federal civilian agencies are legally required to fix because CISA has evidence they are being exploited in the wild. The remediation due date for the flaw is 10 November 2026.

A KEV listing is the strongest signal short of an emergency directive. For federal agencies the deadline is binding. For everyone else running an Adobe Commerce or Magento store, it is a free threat-intelligence briefing: if CISA says a flaw is exploited, assume your own systems are being probed for it too.

The flaw affects Adobe Commerce versions 2.4.4 through 2.4.9. Adobe fixed it in its July security bulletin APSB26-73, so the July releases close the flaw. The danger is the long tail of stores that never applied them.

Patching alone may not be enough

Security firm Sansec traced a persistent JavaScript loader campaign to 953 online stores, mostly Magento, with the latest loader domain found on 83 stores, 60 of them previously infected. That is evidence that compromised stores stay infected for months.

The warning for store owners is that patching closes the hole but does not clean a store that was already breached. Attackers who got in before the patch can leave backdoors and rogue admin accounts behind, and a compromised store can be turned into a skimmer that steals card details from every visitor.

Store owners who have not applied the July bulletin should do so now, then check for signs of compromise, including unfamiliar admin accounts, unexpected files and the loader campaign Sansec documented. If in doubt, get a security review before assuming the store is clean.

A second flaw shares today's deadline

The same 10 November deadline applies to a second flaw CISA added to the KEV catalogue on the same day: CVE-2026-111497, a flaw in Google's Brotli data-compression library, scoring 9.2. Brotli is built into web browsers, servers and countless applications, so its blast radius is enormous even though the fix is a version bump, to Brotli 1.0.10, 1.1.1 or 1.2.1.

For both flaws, CISA lists ransomware use as unknown. What is established is that both are being exploited in the wild. The patch for PolyShell has existed since July and the patch for Brotli since October. The only question now is who gets there first: the store owner, or the attacker.