CVE-2026-48356: Magento 'PolyShell' Flaw Now Confirmed Exploited — Patch Adobe Commerce Now

Published November 7, 2026. CVE-2026-48356 was added to CISA's exploited-vulnerability list on October 27, 2026.

If you run an online store on Magento or Adobe Commerce, this is the one to stop and fix. CVE-2026-48356, the bug security firm Sansec nicknamed PolyShell, lets an outsider upload files to a store without logging in. On many setups those files can then run as code on the server.

Sansec has been warning about it since March 2026, and Adobe shipped fixes for supported versions in July. On October 27 the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog, its official list of bugs confirmed to be used in real attacks. US federal agencies have until November 10 to fix it.

The main points

• What it is: an unrestricted file upload flaw (CWE-434) in Adobe Commerce and Magento Open Source. Sansec says the files can be disguised as images to slip past checks.
• How bad: Adobe rates it Critical, CVSS 9.6. NVD lists it at 9.3. No account or password is needed.
• What an attacker gets: depending on how the web server is set up, code running on the store's server, or malicious scripts that can steal shopper sessions and data.
• Is it being used: yes. Sansec reported attacks from March 16, 2026, and a mass attack wave on March 30. CISA confirmed active exploitation on October 27.
• What's affected: Adobe Commerce, Commerce B2B and Magento Open Source up to and including 2.4.9 (B2B 1.5.3), plus Adobe Commerce Events 1.6.0 to 1.20.0, unless the July 2026 fix is installed.
• What to do: install Adobe's APSB26-73 update (the "2026-jul" releases), then check the store for files planted before you patched.

What is CVE-2026-48356?

Magento is open-source e-commerce software, and Adobe Commerce is the paid version Adobe sells on top of it. Together they run a large number of online shops, from small independent stores to big retail brands.

Like most shop software, Magento lets customers attach files to products, for example a logo for a custom T-shirt. According to Sansec and The Hacker News, PolyShell sits in the store's REST API, the behind-the-scenes interface that apps and checkout pages use to talk to the store. The API accepted file uploads as part of a cart item's custom options without checking properly what kind of file it was getting.

That's what security people call a dangerous file upload: an attacker can plant a file of their choosing on the server. On the cleus.ai/zero-days page we describe this class of bug as "plant and run attacker tools". If the web server is configured to run that file, the attacker can run their own code on the store. If it isn't, Sansec warns the file still sits on disk and can become dangerous after a later configuration change.

Adobe's bulletin describes the impact as arbitrary code execution and privilege escalation, and lists the attack as needing no privileges. Adobe's 9.6 and NVD's 9.3 differ only on the impact to availability; both rate it Critical and both say no login is needed.

How attackers are exploiting CVE-2026-48356

This is advisory-level only. We won't publish how to reproduce it.

In plain terms, the attacker sends a store a crafted upload that looks like an ordinary image but contains something else. Because no login is needed, they can do this to any exposed store, and they have done it at scale.

What's been reported so far:

• March 16, 2026: Sansec first saw exploitation activity. It published its warning on March 17, when there was no production patch.
• Late March: The Hacker News, citing Sansec, reported automated mass scanning from at least 50 IP addresses.
• March 30: Sansec described a mass attack wave that planted web shells (hidden remote-control files) and injected JavaScript into stores. Taiwanese outlet iThome, citing Sansec, reported 471 stores compromised within one hour that day.
• October 24: Sansec linked PolyShell to a campaign that loads malicious scripts from a store's content blocks, according to a Rescana write-up citing Sansec.
• October 27: CISA added CVE-2026-48356 to its exploited list. CISA's ransomware field for it is "Unknown".

Why shoppers should care: injected JavaScript on a checkout page is how card skimmers work. They copy what you type, including card numbers, and send it to the attacker. Sansec's reporting describes injected scripts on compromised stores, though neither Adobe nor CISA has published victim details or attributed the attacks to a named group.

Am I affected by CVE-2026-48356?

This is a server-side bug. Shoppers don't need to update anything on their phones or computers, but store owners, developers and agencies do. According to Adobe's APSB26-73 bulletin, these versions are affected:

Two details trip people up:

• 2.4.9 is on the list. Sansec says 2.4.9 shipped with a fix in May, but Adobe's bulletin lists 2.4.9 as affected and fixed in 2.4.9-2026-jul. Follow Adobe's list.
• Old Open Source stores have no backport. According to Rescana's summary of Adobe's guidance, isolated patches only apply at the latest patch level of each line, and Open Source patches cover 2.4.6 and later. A store on 2.4.5 or older Open Source needs to upgrade, not just patch.

If you're not sure what your store runs, ask your developer or hosting provider, or use Adobe's Commerce version tools described in the bulletin.

How to protect yourself

For store owners, the order matters: patch first so no new files can be planted, then clean up anything that arrived before you patched. Patching does not delete files that are already on the server. iThome reported a case where a store was fully patched but attackers had already created an admin account and installed a backdoor.

After cleaning up, change the passwords and keys the store uses: admin logins, database passwords and API integration keys. Review the admin user list for accounts nobody recognises.

If you can't patch today, Sansec and Adobe point to two stopgaps. First, block web access to the custom options upload folder (pub/media/custom_options/) using Adobe's sample web server configuration, and test that the block actually works. Second, put a web application firewall in front of the store that filters the vulnerable API calls. Sansec stresses that blocking the folder limits the damage but doesn't stop uploads, so treat it as a holding measure.

For shoppers, there's nothing to patch, but there are sensible habits:

• Pay with a wallet (Apple Pay, Google Pay, PayPal) or a virtual card where you can, so a skimmer never sees your real card number.
• Turn on transaction alerts with your bank and check statements after shopping at smaller stores.
• If a checkout page suddenly looks different or asks for card details twice, stop and pay another way.

Track every exploited vulnerability

CISA adds new bugs to its exploited list most weeks. Our live catalogue at cleus.ai/zero-days translates each one into plain English, with what it affects and what to do. This flaw has its own page at the CVE-2026-48356 tracker page, with the official deadline and the vendor's fix in one place.

CVE-2026-48356 FAQ

What is CVE-2026-48356?

CVE-2026-48356 is a critical unrestricted file upload vulnerability in Adobe Commerce and Magento Open Source. Security firm Sansec named it PolyShell. It lets an attacker upload files through the store's REST API without logging in, and depending on server configuration those files can run as code or inject malicious scripts.

Is the Magento PolyShell vulnerability being exploited?

Yes. Sansec reported exploitation starting March 16, 2026, and a mass attack wave on March 30. CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog on October 27, 2026, which means it has evidence of real-world attacks. US federal agencies must fix it by November 10, 2026.

Which Magento versions are patched?

Adobe's July 2026 releases fix it: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul for Magento Open Source, plus matching 2026-jul releases for Adobe Commerce lines back to 2.4.4 and Commerce B2B. Adobe Commerce Events is fixed in 1.21.0. Anything older on each line is affected.

Does installing the patch remove a PolyShell infection?

No. The patch stops new uploads, but files planted before you patched stay on the server. After updating, check the custom options upload folder and CMS blocks for unexpected files or scripts, review admin accounts, and rotate admin, database and API passwords. If you find a backdoor, consider a professional cleanup.

Can shoppers be affected by CVE-2026-48356?

Indirectly. The bug is in the store's server, so shoppers have nothing to update. But attackers who compromise a store can inject scripts that skim card details at checkout. Paying with a digital wallet or virtual card and turning on bank transaction alerts lowers the risk.

What is the CVSS score of CVE-2026-48356?

Adobe's bulletin APSB26-73 gives it a CVSS 3.1 base score of 9.6, rated Critical. NVD lists 9.3, also Critical. The small difference comes from how each scores the impact on availability. Either way it needs no login, which is why it spread quickly.

What if I can't update Magento right away?

Block web access to the pub/media/custom_options folder using Adobe's sample server configuration and confirm the block works. Add a web application firewall that filters the vulnerable API calls. Sansec warns these steps limit damage but don't stop uploads, so schedule the real update as soon as possible.

Want a straight answer about your own store or setup? Cleus is an uncensored AI assistant that can walk you through checking your version, reading Adobe's bulletin, or planning a cleanup.

Sources

• Adobe security bulletin APSB26-73 (Adobe Commerce)
• CISA Known Exploited Vulnerabilities catalog
• NVD: CVE-2026-48356
• Sansec: Magento PolyShell research
• The Hacker News: Magento PolyShell flaw
• SecurityOnline: CISA adds Adobe Magento and Google Brotli flaws to KEV
• Rescana: CVE-2026-48356 file upload flaw added to KEV
• iThome: PolyShell attacks on Magento stores