# Magento "PolyShell" detection pack: CVE-2026-48356 (Adobe APSB26-73)

Read-only checkers and hunting content for CVE-2026-48356, an unrestricted file upload vulnerability (CWE-434) in Adobe Commerce, Magento Open Source, Adobe Commerce B2B and Adobe Commerce Events. Adobe fixed it in security bulletin APSB26-73 on 14 July 2026, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 27 October 2026. Last refreshed 27 October 2026, 19:30 GMT, against Adobe, CISA (KEV feed), NVD and CVE.org primary sources.

"PolyShell" is a name used in public research, not by Adobe, CISA or NVD.

## Status at a glance (checked 27 Oct 2026)

| Item | Status | Source |
|---|---|---|
| Adobe bulletin | APSB26-73, published 14 Jul 2026, last updated 11 Aug 2026, Priority 2. CVE-2026-48356: Critical, impact "Privilege escalation", no authentication required, CVSS 3.1 **9.6** `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L` | [APSB26-73](https://helpx.adobe.com/security/products/magento/apsb26-73.html) |
| NVD | `Analyzed`. NVD (Primary) and Adobe (CNA, Secondary) both score **9.3** CRITICAL `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`. Published 14 Jul 2026 | [NVD CVE-2026-48356](https://nvd.nist.gov/vuln/detail/CVE-2026-48356) |
| CVE record | CNA Adobe, CVSS 9.3 (`A:N`), CWE-434 | [CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-48356) |
| Exploitation | **Exploited in the wild: CISA KEV listing, 27 Oct 2026.** Adobe's bulletin (last updated 11 Aug) still says it is "not aware of any exploits in the wild". Public research reports widespread attempts against Magento stores | [KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) |
| CISA KEV | `dateAdded` 2026-10-27, `dueDate` 2026-11-10 (CISA due date 10 Nov 2026 applies to US federal agencies only, under BOD 26-04; patch now regardless), `knownRansomwareCampaignUse` Unknown, `forensicTriage` No (catalog `2026.10.27`) | [KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) |
| Fix | Adobe's July 2026 **isolated patches** (`<line>-2026-jul`) per release line, or the latest `magento/magento-cloud-patches` on Commerce Cloud; Commerce Events 1.21.0. No new Composer release ships the fix | APSB26-73, [KA-37421](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421) |

**Score note.** Adobe's bulletin says 9.6 (`A:L`), but Adobe's own CNA record in CVE.org and NVD say 9.3 (`A:N`). Use NVD's **9.3** as the reference score and mention that the bulletin lists 9.6.

### CISA KEV (verbatim fields from the feed)

Fetched from the [KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) at 19:21 GMT on 27 Oct 2026 (catalog `dateReleased` `2026-10-27T19:00:02.2307Z`, 19:00 GMT; 1760 entries).

| Field | CVE-2026-48356 |
|---|---|
| `catalogVersion` | `2026.10.27` |
| `vendorProject` | `Adobe` |
| `product` | `Commerce and Magento` |
| `vulnerabilityName` | `Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability` |
| `dateAdded` | `2026-10-27` |
| `dueDate` | `2026-11-10` |
| `knownRansomwareCampaignUse` | `Unknown` |
| `forensicTriage` | `No` |
| `cwes` | `CWE-434` |
| `shortDescription` | "Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session." |
| `requiredAction` | "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." |
| `notes` | [Adobe APSB26-73](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html); [BOD 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk); [Forensics Triage Requirements](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk); [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-48356) |

**Due date.** The 10 Nov 2026 KEV due date is binding only on US federal civilian agencies under BOD 26-04. It is not a deadline for anyone else: UK and other organisations should patch now regardless. `forensicTriage` is `No`, so CISA does not require the BOD 26-04 forensic triage for this entry, but the hunt below still applies.

## Affected and fixed versions (Adobe APSB26-73)

| Product | Affected (Adobe, verbatim) | Fixed (Adobe) |
|---|---|---|
| Adobe Commerce | 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier; 2.4.5-p17 and earlier; 2.4.4-p18 and earlier | 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul |
| Adobe Commerce B2B | 1.5.3; 1.5.2-p5 and earlier; 1.4.2-p10 and earlier; 1.3.4-p17 and earlier; 1.3.3-p18 and earlier | 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul |
| Magento Open Source | 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier | 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul |
| Adobe Commerce Events | 1.6.0 to 1.20.0 | 1.21.0 |
| Adobe Commerce on cloud infrastructure | as above | latest `magento/magento-cloud-patches` (KA-37421) |

What `-2026-jul` means: per [KA-37421](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421) (updated 20 Aug 2026), it is an **isolated patch** applied on top of the latest security release of each line (for example 2.4.8-p5 plus the July patch), not a new Composer version. Adobe's most recent Composer security releases are still the 12 May 2026 ones, so a version string alone cannot show whether a store is fixed. Confirm with Adobe's Commerce Version Tool (`vendor/bin/patch-status`) or the Quality Patches Tool. The 2.4.4 and 2.4.5 patch downloads need Adobe Commerce Composer keys, and Magento Open Source downloads cover 2.4.6 and later only.

NVD's CPE configuration lists commerce 2.4.4 to 2.4.9, commerce_b2b 1.3.3 to 1.5.3, magento (Open Source) 2.4.6 to 2.4.9 and Commerce Events (I/O Events) 1.6.0 up to but not including 1.21.0. Lines older than 2.4.4 (and Open Source older than 2.4.6) are out of support and get no patch: treat them as vulnerable.

## Attack path: what is and is not confirmed

- **Confirmed (Adobe, NVD, CISA):** unrestricted upload of a file with a dangerous type (CWE-434), exploitable over the network without authentication; NVD's vector needs user interaction (`UI:R`). Adobe calls the impact "Privilege escalation"; CISA's KEV text says it "could result in arbitrary code execution".
- **Public research only, not confirmed by Adobe, NVD or CISA:** the file is uploaded through a product's file-type custom option via the guest-cart REST API (`POST /rest/<store>/V1/guest-carts/<cartId>/items` and `PUT /rest/<store>/V1/guest-carts/<cartId>/items/<itemId>`), lands in `pub/media/custom_options/quote/`, and can be a "polyglot" (a valid image that also contains PHP). This pack's detections use that path because it is the best public description, and every rule says so.
- **What the patch shows:** we compared Adobe's July 2026 isolated patch files for 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. They add guest-cart ownership checks (a new `Magento\Quote\Model\GuestCart\GetGuestCart` with `checkIsGuestCart`, used by `GuestCartItemRepository`; Commerce adds the same check to `GiftCardAccountManagement`; B2B adds `SanitizeCompanyName`). No hunk changes the custom-option file upload code. So the patch blocks the guest-cart route, but a store with a web server that executes PHP under `pub/media` stays exposed to any other upload path. Harden the web server as well as patching.

## Proactive steps

1. **Patch now.** Apply the July 2026 isolated patch for your line (KA-37421), or upgrade `magento/magento-cloud-patches` on Commerce Cloud; Commerce Events to 1.21.0. Lines below 2.4.4 (Open Source below 2.4.6): upgrade to a supported line. Confirm with `vendor/bin/patch-status` (run it yourself; it fetches patch data over the network and writes a log).
2. **Stop PHP from running in `pub/media`, using Adobe's own sample config** ([`nginx.conf.sample`](https://github.com/magento/magento2/blob/2.4-develop/nginx.conf.sample), [`pub/media/.htaccess`](https://github.com/magento/magento2/blob/2.4-develop/pub/media/.htaccess), [`pub/media/custom_options/.htaccess`](https://github.com/magento/magento2/blob/2.4-develop/pub/media/custom_options/.htaccess)):
   - **nginx:** Adobe's sample has `location /media/custom_options/ { deny all; }` (and the same for `customer`, `customer_address`, `downloadable`, `import`), and only passes a whitelist of entry points to PHP: `location ~ ^/(index|get|static|errors/report|errors/404|errors/503|health_check)\.php$`. Keep both. A plain prefix `location /media/custom_options/` loses to any regex location such as `location ~ \.php$`, so if you have a generic PHP location, use `location ^~ /media/custom_options/ { deny all; }` and a `location ~* ^/(pub/)?media/.*\.(php|phtml|phar)` deny placed before it.
   - **Apache:** keep Adobe's `pub/media/.htaccess` (`php_flag engine 0`, `<FilesMatch ".*\.(ph(p[3457]?|t|tml)|[aj]sp|p[ly]|sh|cgi|shtml?|html?)$"> SetHandler default-handler </FilesMatch>`) and `pub/media/custom_options/.htaccess` (`Require all denied`). `php_flag engine 0` only works with mod_php; with PHP-FPM (`SetHandler "proxy:fcgi://..."`) the `SetHandler default-handler` block and the deny are what protect you. Check `AllowOverride` actually lets these files apply, or copy the rules into the vhost.
3. **WAF: block or rate-limit file-option uploads on guest carts.** Most stores never take customer file uploads through the guest-cart API. Block (or, if you sell products with file options, rate-limit and log) `POST`/`PUT` to `/rest/*/V1/guest-carts/*/items*` whose JSON body carries a custom-option file (`file_info` / `base64_encoded_data` in Magento's REST schema; check your version's `/rest/all/schema`). Block all requests to `/media/custom_options/` and to PHP files under `/media/`.
4. **Check PHP-FPM is not handed every `.php`.** Remove generic `location ~ \.php$ { fastcgi_pass ...; }` blocks in favour of Adobe's whitelist, keep `security.limit_extensions = .php` in the FPM pool, and make sure images or other extensions are never mapped to the PHP handler (`AddHandler`/`AddType application/x-httpd-php .jpg` and similar).

## Reactive steps (hunt), and why patched does not mean clean

Patched does not mean clean. A store that ran an affected build while this was being exploited may already hold a web shell or card skimmer, and the patch removes neither. Hunt over the whole period the store was unpatched:

1. **Unexpected files in `pub/media/custom_options/quote/`.** Anything with a script or server-config extension (`.php`, `.phtml`, `.phar`, `.htaccess`, `.user.ini`, double extensions such as `x.php.jpg`), SVG/HTML files, or files whose content does not match their image extension. The checkers do this.
2. **Images that contain PHP.** Files whose bytes include `<?php` or `<?=`, even with valid image headers (polyglots). Do not open or include them in PHP; read them as bytes only.
3. **`.php`, `.phtml`, `.phar` files anywhere under `pub/media`** (Magento ships none there), and recently changed PHP files elsewhere in the web root.
4. **Access logs:** guest-cart item `POST`/`PUT` followed by a `GET` into `/media/custom_options/quote/` from the same IP, any served (2xx) request into that folder, and any request for a PHP file under `/media/` (KQL Q1 to Q5, Sigma webserver rules).
5. **New admin users** (Admin > System > Permissions > All Users, or read-only `SELECT user_id, username, email, created, logdate FROM admin_user ORDER BY created DESC;`), and new integrations or API tokens.
6. **Changed CMS blocks, pages and checkout JavaScript:** `cms_block` / `cms_page` `update_time`, `core_config_data` paths such as `design/head/includes` and `design/footer/absolute_footer`, and changed `.js` / `.phtml` files in themes, `pub/static` and checkout modules (skimmers). KQL Q10 looks for web workers writing these.
7. **Web workers spawning shells or tools** (KQL Q8/Q9, Sigma process_creation rules).

**If you find something:**

1. Keep the evidence first: copy the web server and application logs and the suspicious files (read-only copies, hashes, timestamps) before changing anything.
2. Take the store into maintenance mode if a skimmer or shell is confirmed, remove the web shells and injected code, and patch.
3. Rotate secrets: all admin passwords and 2FA, the database password, the `crypt/key` in `app/etc/env.php` (with Adobe's key-rotation process), integration and API tokens, and payment gateway keys. Tell your payment provider if card data may have been exposed.
4. Run a full malware scan of the code base and database, and rebuild from a known-good release if you cannot be sure the clean-up is complete.

## Files

| File | Purpose |
|---|---|
| `scripts/check-polyshell.sh` | Linux checker (bash), read-only |
| `scripts/Check-PolyShell.ps1` | PowerShell 5.1+/7 port with the same output (Windows or Linux pwsh), read-only |
| `kql/polyshell-hunting.kql` | Sentinel / Defender XDR hunting queries Q1 to Q10 (not run against a live tenant) |
| `sigma/*.yml` | 11 Sigma rules: webserver (4 plus a temporal correlation), file_event (Linux and Windows), process_creation (Linux and Windows) |
| `tests/run_tests.sh` | Test runner: bash checker tests, read-only and safety checks, shellcheck, PSScriptAnalyzer, content checks, `sigma check` / convert, Pester |
| `tests/Check-PolyShell.Tests.ps1` | Pester tests for the PowerShell checker |
| `tests/fixtures/` | Mock Magento trees (`composer.lock` / `composer.json`, inert patch-marker text files), web server configs and synthetic access logs (RFC 5737 documentation IPs and `PLACEHOLDER` names only). Suspicious upload files are generated at test time, never shipped |

## Checker usage

```bash
bash scripts/check-polyshell.sh --magento-root /var/www/magento
bash scripts/check-polyshell.sh --magento-root /var/www/magento \
     --web-config /etc/nginx/sites-enabled/magento.conf \
     --access-log /var/log/nginx/access.log --access-log /var/log/nginx/access.log.2.gz
POLYSHELL_MAX_LIST=500 bash scripts/check-polyshell.sh --magento-root /var/www/magento   # list more indicators (default 200)
```

```powershell
.\scripts\Check-PolyShell.ps1 -MagentoRoot 'D:\www\magento'
.\scripts\Check-PolyShell.ps1 -MagentoRoot /var/www/magento -WebConfig /etc/nginx/sites-enabled/magento.conf -AccessLog /var/log/nginx/access.log,/var/log/nginx/access.log.2.gz -MaxList 500
```

What the checkers do (read-only):

- **Version:** read `composer.lock` (or `composer.json` / a git checkout's root `composer.json`) for `magento/product-community-edition`, `product-enterprise-edition`, `extension-b2b` and `commerce-eventing`.
- **Patch markers:** look for content Adobe's July 2026 isolated patch adds (`GetGuestCart.php` with `checkIsGuestCart`, `GuestCartItemRepository` / `GiftCardAccountManagement` calling `getGuestCart->execute(`, B2B `SanitizeCompanyName.php`) under `vendor/` and `app/code/`. They show the patch was applied; Adobe does not say which hunk fixes this CVE.
- **Upload folder:** list every file under `pub/media/custom_options/quote/` (symlinks are reported, not followed) and read its bytes for PHP tags and image magic; list PHP/script files anywhere under `pub/media`.
- **Web config (optional):** nginx or Apache, informational RISK/WARN/OK lines against Adobe's sample config.
- **Access logs (optional, combined/common format, `.gz` OK):** guest-cart write counts and top sources (informational), requests into the quote folder (flagged as a sequence when the same IP made a guest-cart write first) and PHP files requested under `/media/`.

They never write, move, delete, quarantine, execute or `include` any file, never call the guest-cart or any other Magento API, send no network traffic, contain no exploit payloads and do not run `bin/magento` or `vendor/bin/patch-status`. Every run ends with the KEV status, the federal-only due-date note, the Adobe patch reminder and "PATCHED DOES NOT MEAN CLEAN".

| Verdict | Exit code | Meaning |
|---|---|---|
| PATCHED | 0 | All July 2026 patch markers present (2.4.6 to 2.4.9 / B2B 1.4 and later), a release line newer than 2.4.9, or Commerce Events 1.21.0+; and no indicators |
| LIKELY VULNERABLE | 1 | Version in Adobe's affected range with no patch markers, or an unsupported line (below 2.4.4) |
| UNKNOWN | 2 | Version unreadable or only a constraint, partial markers, markers on 2.4.4/2.4.5 or B2B 1.3 (patch layout not verified), Commerce Cloud patch packages (confirm with `patch-status`), pre-release builds, Commerce Events below 1.6, or no Magento found |
| INDICATORS FOUND | 1 | Any suspicious upload-folder file, PHP file under `pub/media`, or served (2xx) log request into the quote folder or for media PHP. Forces exit 1 even when the version is PATCHED |
| error | 3 | Missing or unreadable `--magento-root`, unreadable config or log, unknown argument |

The overall result is the worst version verdict across the products found. Web-config findings, guest-cart counts and refused/not-found probes are informational and do not change the exit code.

## Detection content notes

- **No IOCs.** Adobe and CISA published none and none are invented here. Fixture names are `PLACEHOLDER-*`, IPs are RFC 5737 documentation ranges. Everything is behavioural.
- **The KQL has not been run against a live tenant.** It follows the documented Sentinel / Defender XDR schemas (`W3CIISLog`, `CommonSecurityLog`, `AzureDiagnostics`, `Syslog`, `DeviceFileEvents`, `DeviceProcessEvents`), but fields marked `UNVERIFIED FIELD` (CommonSecurityLog status in `AdditionalExtensions`, AzureDiagnostics column suffixes for Application Gateway / Front Door, Linux `FolderPath` format) and lines marked `ASSUMPTION` (Syslog carrying combined-format access logs, the web-worker process names) must be checked in your workspace. Windows (IIS) shows `scStatus` as a string, so queries convert it with `toint()`. Baseline before alerting: normal shoppers use the guest-cart endpoints.
- **Sigma:** all 11 rules pass `sigma check` (sigma-cli 3.1.0: "Found 0 errors, 0 condition errors and 0 issues"). With `sigma convert -t kusto --without-pipeline`, the 10 detection rules convert; the temporal correlation `polyshell_webserver_guest_cart_then_quote_request.yml` does not, because the Kusto backend reports "Backend does not support correlation rules". Use KQL Q5 in Sentinel, or a SIEM backend that supports Sigma correlations; load it with its two base rules (`polyshell_webserver_guest_cart_item_write.yml`, `polyshell_webserver_quote_folder_any.yml`). Converted webserver rules use the generic Sigma field names (`cs-uri-query`, `cs-method`, `sc-status`, `c-ip`); map them to your table's columns (for example W3CIISLog `csUriStem`, `csMethod`, `scStatus`, `cIP`).
- Treat every hit as a lead to investigate, not proof of compromise.

## Corrections to the claims we were given

| Claim | Finding | Source |
|---|---|---|
| Affected versions | Each line has its own ceiling: Commerce also includes 2.4.7-p10 and 2.4.5-p17 and earlier, Open Source 2.4.7-p10, B2B 1.5.3 / 1.5.2-p5 / 1.4.2-p10 / 1.3.4-p17 / 1.3.3-p18, and Commerce Events 1.6.0 to 1.20.0 (fixed 1.21.0) | APSB26-73, NVD CPEs |
| Attack path (guest-cart POST/PUT, `pub/media/custom_options/quote/`) | **Not confirmed** by Adobe, NVD or CISA (public research only). The July patch adds guest-cart ownership checks and does not touch the file-upload code | APSB26-73, KA-37421 patch files |
| Adobe 9.6, NVD 9.3 | Correct as stated, but Adobe's own CNA record (CVE.org) and NVD's Adobe Secondary score are 9.3 (`A:N`); the 9.6 (`A:L`) appears only in the bulletin. NVD 9.3 is the reference | APSB26-73, CVE.org, NVD |
| KEV added 27 Oct 2026, due 10 Nov 2026 | Confirmed. Also `knownRansomwareCampaignUse` Unknown, `forensicTriage` No, catalog `2026.10.27`. The due date applies to US federal agencies only | KEV feed |
| Percentage of stores attacked | **Not in any primary source** (security-vendor statistic only). Not repeated here; we only say public research reports widespread attempts | none |
| Fix APSB26-73, 14 Jul 2026 | Confirmed (published 14 Jul 2026, last updated 11 Aug 2026) | APSB26-73 |
| "2026-jul releases" | These are isolated patches on top of the latest security release, not Composer versions; Commerce Cloud uses `magento-cloud-patches` | KA-37421 |
| Exploitation | Adobe's bulletin still says "not aware of any exploits in the wild"; CISA's KEV listing (27 Oct 2026) is the primary confirmation of exploitation | APSB26-73, KEV |
| Severity wording | Adobe: "Privilege escalation", no authentication; NVD vector needs user interaction (`UI:R`); CISA KEV: "could result in arbitrary code execution". CISA's ADP SSVC entry (15 Jul 2026) said exploitation "none", automatable "no", technical impact "total" (written before the KEV listing) | APSB26-73, NVD, KEV |

**Still unverified:** the "PolyShell" name, the exact endpoints and upload folder, the polyglot technique, which patch hunk fixes the CVE, the isolated-patch file layout for 2.4.4 / 2.4.5 and B2B 1.3 (those downloads need Commerce Composer keys, so the checkers return UNKNOWN there), and every KQL column marked `UNVERIFIED FIELD`.

## Running the tests

```bash
bash tests/run_tests.sh   # uses ~/tools/shellcheck-v0.10.0, ~/tools/pwsh and ~/tools/sigmavenv (override with SHELLCHECK, PWSH, SIGMA)
```

The runner builds suspicious upload files in a temporary folder at run time (none are shipped), checks that the checkers change nothing (names, sizes, modes and mtimes), and puts an executable sentinel file (`run.sh` / `run.jpg`) in the upload folder. A control test first proves running it creates the sentinel; the checker runs must leave it untouched.

## Limitations

- A version string cannot prove the July patch is applied, so the checkers rely on patch-file markers; customised or relocated code can give false results. Confirm with Adobe's `vendor/bin/patch-status`.
- The upload-folder scan reads every file in full; very large media trees take time. Web-config parsing is heuristic and does not follow `include` directives; pass each included file with another `--web-config`.
- Access-log parsing assumes common/combined format. Behind a CDN or load balancer, the client IP in the log may be the proxy's.
- The checkers do not inspect the database (admin users, CMS blocks, config), cron jobs or other persistence; do those by hand as described above.

## Sources

- Adobe: [APSB26-73 (helpx)](https://helpx.adobe.com/security/products/magento/apsb26-73.html), [APSB26-73 (URL in CISA's KEV notes)](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html); [KA-37421 isolated patches](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421); Adobe's Magento sample configs in [magento/magento2](https://github.com/magento/magento2/blob/2.4-develop/nginx.conf.sample)
- CISA: [KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json); [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog); [BOD 26-04](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk); [BOD 26-04 forensic triage guidance](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)
- NVD: [CVE-2026-48356](https://nvd.nist.gov/vuln/detail/CVE-2026-48356)
- MITRE: [CVE.org record](https://www.cve.org/CVERecord?id=CVE-2026-48356); [CWE-434](https://cwe.mitre.org/data/definitions/434.html); [ATT&CK T1505.003 Web Shell](https://attack.mitre.org/techniques/T1505/003/)