---
schema: 1
kind: vulnerability
title: "CVE-2026-48356 (PolyShell), Adobe Commerce and Magento Open Source: an unauthenticated file upload attacked since March 2026, fixed for supported lines in July, and listed by CISA as exploited on 2026-10-27"
headline: "PolyShell (CVE-2026-48356): Magento upload flaw attacked since March, fixed in July, CISA lists it as exploited"
summary: >
  Sansec reports that PolyShell, the unauthenticated file upload in the Magento and Adobe Commerce REST API that Adobe tracks as CVE-2026-48356,
  has been attacked since 2026-03-19, with a mass wave on 2026-03-30 that put a JavaScript loader on 471 stores in one hour. Adobe's bulletin
  APSB26-73 of 2026-07-14 names the 2026-jul builds as the fix and still says Adobe knows of no exploits, while Sansec says Magento 2.4.9 carried a fix on 2026-05-12;
  CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-27. A store that ran an unpatched build may carry a webshell
  that the update does not remove.
discovered_at: "2026-10-28T03:54:00Z"
updated_at: null
event_date: "2026-10-27"
run_id: 2026-10-28T0256Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, actively-exploited, cisa-kev, patch-available]
regions: [global]
sectors: [retail, technology]
entities: ["product:adobe-commerce", "product:adobe-commerce-b2b", "product:magento-open-source"]
techniques: [T1190, T1505.003]
affected_products: ["Adobe Commerce", "Adobe Commerce B2B", "Magento Open Source"]
cves:
  - id: CVE-2026-48356
    cvss: "9.6 (CVSS 3.1, Adobe bulletin; Adobe's CVE record says 9.3)"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "Magento Open Source and Adobe Commerce up to 2.4.9-alpha2 per Sansec; Adobe's bulletin lists Adobe Commerce 2.4.9 and 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18 and earlier, Magento Open Source 2.4.9 and 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15 and earlier, and Adobe Commerce B2B 1.5.3 and 1.5.2-p5, 1.4.2-p10, 1.3.4-p17 and 1.3.3-p18 and earlier (its version table covers every fix of the update)"
    fixed: "the 2026-jul builds of every line per bulletin APSB26-73 (2026-07-14), 2.4.9-2026-jul included; Sansec says plain 2.4.9 of 2026-05-12 carries a fix, which Adobe's bulletin does not reflect"
sources:
  - url: "https://sansec.io/research/magento-polyshell"
    publisher: "Sansec (PolyShell advisory)"
    date: "2026-03-17"
    role: primary
  - url: "https://sansec.io/research/polyshell-mass-attack-wave"
    publisher: "Sansec (mass PolyShell attack wave)"
    date: "2026-03-30"
    role: corroborating
  - url: "https://sansec.io/research/magento-cms-block-loader-deepveindrilling"
    publisher: "Sansec (CMS block loader campaign)"
    date: "2026-10-24"
    role: corroborating
  - url: "https://www.adobe.com/trust/security/products/commerce/apsb26-73.html"
    publisher: "Adobe (security bulletin APSB26-73)"
    date: "2026-07-14"
    role: primary
  - url: "https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog"
    publisher: "CISA (alert, CISA Adds Two Known Exploited Vulnerabilities to Catalog)"
    date: "2026-10-27"
    role: corroborating
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA Known Exploited Vulnerabilities catalog (version 2026.10.27)"
    date: "2026-10-27"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Sansec discovered and named the PolyShell vulnerability (CVE-2026-48356): a critical flaw in Magento's REST API that lets unauthenticated attackers upload executable files to any store."
    publisher: "Sansec (PolyShell advisory)"
    source_url: "https://sansec.io/research/magento-polyshell"
  - quote: "Even when execution is blocked, the uploaded file stays on disk."
    publisher: "Sansec (PolyShell advisory)"
    source_url: "https://sansec.io/research/magento-polyshell"
  - quote: "In March the operator injected the loader into 471 stores in one hour, after uploading webshells through PolyShell (CVE-2026-48356)."
    publisher: "Sansec (CMS block loader campaign)"
    source_url: "https://sansec.io/research/magento-cms-block-loader-deepveindrilling"
  - quote: "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates."
    publisher: "Adobe (security bulletin APSB26-73)"
    source_url: "https://www.adobe.com/trust/security/products/commerce/apsb26-73.html"
verification: multi-source
sourcing_note: >
  Sansec, a Magento security vendor, is the source for the exploitation history, the attack chain and the fix timeline, and its counts come from
  its own protected stores and scans. Adobe's bulletin of 2026-07-14, last updated on 2026-08-11, still says Adobe knows of no exploits, which
  Sansec's account contradicts, and it lists 2.4.9 as affected where Sansec says 2.4.9 carries a fix. It scores the flaw 9.6 where Adobe's CVE
  record says 9.3 and rates it as needing user interaction, while Sansec describes an anonymous upload. CISA's listing says only that it rests on evidence of active exploitation.
confidence: high
references: ["2026-10-14/adobe-october-2026-coldfusion-aem-commerce-unauth-critical"]
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Update every Magento Open Source and Adobe Commerce store, those on 2.4.9 included, to the 2026-jul fix in bulletin APSB26-73, then check for compromise: any script file in the custom-options upload directory, administrator accounts nobody created and loader scripts in CMS blocks, because a store that ran an unpatched build since March 2026 may already hold a webshell that the update does not remove."
updates: []
migrated_from: null
---

Sansec named the flaw PolyShell: a missing validation in Magento's REST API that lets unauthenticated attackers upload executable files to a store, using a polyglot (code disguised as an image) to pass the image check ([Sansec, 2026-03-17](https://sansec.io/research/magento-polyshell)). It reports that its Shield service has blocked exploitation attempts against 79.5% of the Magento stores it protects since 2026-03-16, with first attacks observed on 2026-03-19, and that the vulnerable code has existed since the first Magento 2 release ([Sansec, 2026-03-17](https://sansec.io/research/magento-polyshell)). On 2026-03-30 a mass wave uploaded webshells, spread backdoor scripts across several directories and injected a JavaScript loader into the CMS pages of 471 stores within one hour ([Sansec, 2026-03-30](https://sansec.io/research/polyshell-mass-attack-wave)).

Sansec dates a fix in Magento 2.4.9 to 2026-05-12, without a backport to the supported 2.4.8 and 2.4.7 lines, and the backport to those lines to 2026-07-14, in bulletin APSB26-73 ([Sansec, 2026-03-17](https://sansec.io/research/magento-polyshell)). That bulletin rates the flaw Critical at CVSS 3.1 9.6, lists 2.4.9 among the affected versions, names the 2026-jul builds, 2.4.9-2026-jul included, as the fix for Adobe Commerce and Magento Open Source, and still says Adobe is not aware of any exploits in the wild ([Adobe, 2026-07-14](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html)). CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on 2026-10-27 on evidence of active exploitation and gives no detail ([CISA, 2026-10-27](https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog); [CISA KEV, 2026-10-27](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). Sansec's research of 2026-10-24 shows the operator behind the March wave still active: its newest loader domain, registered on 2026-10-06, sits in the CMS blocks of 83 stores, 60 of which already carried an earlier loader, and one of them, on Magento 2.4.7-p1, still lacks APSB26-73 and holds PolyShell webshells disguised as images ([Sansec, 2026-10-24](https://sansec.io/research/magento-cms-block-loader-deepveindrilling)).

**Exposure:** every Magento Open Source and Adobe Commerce store without the 2026-jul fix, 2.4.9 included ([Adobe, 2026-07-14](https://www.adobe.com/trust/security/products/commerce/apsb26-73.html)); the anonymous guest-cart item routes need no credentials, and the upload becomes code execution on stock nginx for the oldest 2.x lines, on any non-stock nginx that hands every .php file to the PHP handler, and on Magento before 2.3.5 running on Apache without the engine switch set for that directory ([Sansec, 2026-03-17](https://sansec.io/research/magento-polyshell)).

**Detection:** Sansec calls any .php, .phtml or .phar file in the custom-options upload directory a strong indicator of compromise, and the uploaded file stays on disk even where execution is blocked ([Sansec, 2026-03-17](https://sansec.io/research/magento-polyshell)); also look for requests that add items to guest carts with embedded file data from unfamiliar sources ([Sansec, 2026-03-17](https://sansec.io/research/magento-polyshell)), script tags in the CMS block table and administrator accounts nobody created ([Sansec, 2026-10-24](https://sansec.io/research/magento-cms-block-loader-deepveindrilling)).

**Defender takeaway:** install the fix now, and treat a store that ran an unpatched build while internet-reachable since March as possibly compromised until its upload directory, CMS blocks and administrator accounts are checked, because an uploaded file stays on disk even where execution is blocked ([Sansec, 2026-03-17](https://sansec.io/research/magento-polyshell)), so the fix does not remove a shell already written (an inference), and deleting a loader script does not remove the access behind it ([Sansec, 2026-10-24](https://sansec.io/research/magento-cms-block-loader-deepveindrilling)).