CVE-2026-48356 (PolyShell), Adobe Commerce and Magento Open Source: an unauthenticated file upload attacked since March 2026, fixed for supported lines in July, and listed by CISA as exploited on 2026-10-27
PolyShell (CVE-2026-48356): Magento upload flaw attacked since March, fixed in July, CISA lists it as exploited
Defender actions
- Update every Magento Open Source and Adobe Commerce store, those on 2.4.9 included, to the 2026-jul fix in bulletin APSB26-73, then check for compromise: any script file in the custom-options upload directory, administrator accounts nobody created and loader scripts in CMS blocks, because a store that ran an unpatched build since March 2026 may already hold a webshell that the update does not remove.
Analysis
Sansec named the flaw PolyShell: a missing validation in Magento's REST API that lets unauthenticated attackers upload executable files to a store, using a polyglot (code disguised as an image) to pass the image check (Sansec, 2026-03-17). It reports that its Shield service has blocked exploitation attempts against 79.5% of the Magento stores it protects since 2026-03-16, with first attacks observed on 2026-03-19, and that the vulnerable code has existed since the first Magento 2 release (Sansec, 2026-03-17). On 2026-03-30 a mass wave uploaded webshells, spread backdoor scripts across several directories and injected a JavaScript loader into the CMS pages of 471 stores within one hour (Sansec, 2026-03-30).
Sansec dates a fix in Magento 2.4.9 to 2026-05-12, without a backport to the supported 2.4.8 and 2.4.7 lines, and the backport to those lines to 2026-07-14, in bulletin APSB26-73 (Sansec, 2026-03-17). That bulletin rates the flaw Critical at CVSS 3.1 9.6, lists 2.4.9 among the affected versions, names the 2026-jul builds, 2.4.9-2026-jul included, as the fix for Adobe Commerce and Magento Open Source, and still says Adobe is not aware of any exploits in the wild (Adobe, 2026-07-14). CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on 2026-10-27 on evidence of active exploitation and gives no detail (CISA, 2026-10-27; CISA KEV, 2026-10-27). Sansec's research of 2026-10-24 shows the operator behind the March wave still active: its newest loader domain, registered on 2026-10-06, sits in the CMS blocks of 83 stores, 60 of which already carried an earlier loader, and one of them, on Magento 2.4.7-p1, still lacks APSB26-73 and holds PolyShell webshells disguised as images (Sansec, 2026-10-24).
Cited evidence
Sansec discovered and named the PolyShell vulnerability (CVE-2026-48356): a critical flaw in Magento's REST API that lets unauthenticated attackers upload executable files to any store.
Even when execution is blocked, the uploaded file stays on disk.
In March the operator injected the loader into 471 stores in one hour, after uploading webshells through PolyShell (CVE-2026-48356).
Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.
Sources6
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.