CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CVE-2026-48356, Adobe Commerce and Magento Open Source: unrestricted file upload fixed in APSB26-73 (CVSS 3.1 9.6), added to CISA KEV on 2026-10-27

cve · CVE-2026-48356

Coverage
1
first 2026-10-28 → last 2026-10-28
Latest activity
2026-10-28
PolyShell (CVE-2026-48356): Magento upload flaw attacked since March, fixed in July, CISA lists it as…
Peak priority
notable
1 notable
Targets
retail
sectors: retail, technology
Sources cited
6
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-48356, newest first. Check the date before acting on an older one.

  • Update every Magento Open Source and Adobe Commerce store, those on 2.4.9 included, to the 2026-jul fix in bulletin APSB26-73, then check for compromise: any script file in the custom-options upload directory, administrator accounts nobody created and loader scripts in CMS blocks, because a store that ran an unpatched build since March 2026 may already hold a webshell that the update does not remove.
    2026-10-28CVE-2026-48356

Defender insights

What each entry about CVE-2026-48356 tells a defender to do, newest first.

2026-10-28NOTABLEexploitedPolyShell (CVE-2026-48356): Magento upload flaw attacked since March, fixed in July, CISA lists it as exploited

Exposure · detection

Story timeline

  1. 2026-10-28CVE-2026-48356 (PolyShell), Adobe Commerce and Magento Open Source: an unauthenticated file upload attacked since March 2026, fixed for supported lines in July, and listed by CISA as exploited on 2026-10-27
    trending-vulnerabilitiesPolyShell (CVE-2026-48356): Magento upload flaw attacked since March, fixed in July, CISA lists it as exploited

Hunting pivots

Affected products
Adobe CommerceAdobe Commerce B2BMagento Open Source
Tags
actively-exploitedcisa-kevpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • PersistenceServer Software Component: Web Shell

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-28/cve-2026-48356-adobe-commerce-magento-upload-flaw-cisa-kev · ATT&CK page ↗

Persistence TA0003

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-10-28/cve-2026-48356-adobe-commerce-magento-upload-flaw-cisa-kev · ATT&CK page ↗

Entries about CVE-2026-48356, Adobe Commerce and Magento Open Source: unrestricted file upload fixed in APSB26-73 (CVSS 3.1 9.6), added to CISA KEV on 2026-10-27 (1)

2026-10-28 · view entry permalink →

NOTABLECVE-2026-48356exploitedNATOB2

CVE-2026-48356 (PolyShell), Adobe Commerce and Magento Open Source: an unauthenticated file upload attacked since March 2026, fixed for supported lines in July, and listed by CISA as exploited on 2026-10-27

Sansec named the flaw PolyShell: a missing validation in Magento's REST API that lets unauthenticated attackers upload executable files to a store, using a polyglot (code disguised as an image) to pass the image check (Sansec, 2026-03-17). It reports that its Shield service has blocked exploitation attempts against 79.5% of the Magento stores it protects since 2026-03-16, with first attacks observed on 2026-03-19, and that the vulnerable code has existed since the first Magento 2 release (Sansec, 2026-03-17). On 2026-03-30 a mass wave uploaded webshells, spread backdoor scripts across several directories and injected a JavaScript loader into the CMS pages of 471 stores within one hour (Sansec, 2026-03-30).

Sansec dates a fix in Magento 2.4.9 to 2026-05-12, without a backport to the supported 2.4.8 and 2.4.7 lines, and the backport to those lines to 2026-07-14, in bulletin APSB26-73 (Sansec, 2026-03-17). That bulletin rates the flaw Critical at CVSS 3.1 9.6, lists 2.4.9 among the affected versions, names the 2026-jul builds, 2.4.9-2026-jul included, as the fix for Adobe Commerce and Magento Open Source, and still says Adobe is not aware of any exploits in the wild (Adobe, 2026-07-14). CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on 2026-10-27 on evidence of active exploitation and gives no detail (CISA, 2026-10-27; CISA KEV, 2026-10-27). Sansec's research of 2026-10-24 shows the operator behind the March wave still active: its newest loader domain, registered on 2026-10-06, sits in the CMS blocks of 83 stores, 60 of which already carried an earlier loader, and one of them, on Magento 2.4.7-p1, still lacks APSB26-73 and holds PolyShell webshells disguised as images (Sansec, 2026-10-24).

Sansec discovered and named the PolyShell vulnerability (CVE-2026-48356): a critical flaw in Magento's REST API that lets unauthenticated attackers upload executable files to any store.

Even when execution is blocked, the uploaded file stays on disk.

Sansec (PolyShell advisory) 2026-03-17

In March the operator injected the loader into 471 stores in one hour, after uploading webshells through PolyShell (CVE-2026-48356).

Sansec (CMS block loader campaign) 2026-10-24

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Adobe (security bulletin APSB26-73) 2026-07-14

Builds on: Adobe fixes unauthenticated CVSS 10.0 flaws in ColdFusion, Experience Manager and Commerce; no…

vulnerability28 Oct 03:54Zmulti-sourceOpen finding →
Sources: Sansec (PolyShell advisory) · Sansec (mass PolyShell attack wave) · Sansec (CMS block loader campaign) · Adobe (security bulletin APSB26-73) · CISA (alert, CISA Adds Two Known Exploited Vulnerabilities to Catalog) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.27)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • sansec.io3 (50%)
  • cisa.gov2 (33%)
  • adobe.com1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)