What happened
CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities catalog on 2026-10-27 with confirmed in-the-wild exploitation. Adobe Commerce/Magento contain an unrestricted file upload that can lead to arbitrary code execution in the context of the current user.
Why it matters
Per the KEV coverage rule and the post-Mythos time-to-exploit compression, this KEV addition is surfaced even though it is not AI-core. It matters to AI deployments only where a Magento storefront fronts an AI/chatbot feature; the primary risk is the standard server-side Web tier, not the AI layer.
Attack vector
Unrestricted upload of a file with a dangerous type (CWE-434) enabling arbitrary code execution in the context of the current user, to escalate access to the victim's account/session. Confirmed in the wild; added to CISA KEV on 2026-10-27.
Affected systems
Adobe Commerce / Magento (updates per APSB26-73)
Mitigation
Apply Adobe APSB26-73 patches; restrict upload types and validate file content; investigate for post-exploitation given KEV status.