On 27 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog. That is the Magento and Adobe Commerce file upload flaw that Sansec named PolyShell back in March. The bug itself is not new, and Adobe has shipped fixes, but a KEV listing is a clear signal that it is still being used in real attacks. If your store hasn't taken the July security update yet, this is the week to do it.
What PolyShell is
According to Sansec's research, Magento's REST API accepts file uploads as part of cart item custom options, and it doesn't check that the option exists on the product, that it is actually a file option, or that the file extension is safe. The only check is an image header, which is easy to fake with a polyglot: a file that is a valid GIF or PNG and also contains PHP. The most dangerous routes are the anonymous guest cart endpoints, so no login is needed. Uploaded files land in pub/media/custom_options/.
Whether an upload turns into remote code execution or stored XSS depends on your web server configuration. Sansec notes that GraphQL mutations use a different code path and are not affected.
How serious it is
- Adobe's rating. In security bulletin APSB26-73 Adobe lists CVE-2026-48356 as critical, CVSS 9.6, exploitable without authentication.
- Attacks in the wild. Sansec reports probing from 16 March 2026, mass scanning from 19 March, and malicious uploads on 82% of the stores it protects by 14 April.
- Follow-up malware. Sansec describes an
accesson.phpbackdoor copied into many folders and obfuscated JavaScript injected into CMS pages and blocks. - CISA listing. Being in the KEV catalog means US federal agencies must remediate it, and CISA encourages every organisation to treat KEV entries as a priority.
Which versions are fixed
Adobe released the fix in Magento 2.4.9 in May, and on 14 July 2026 backported it to supported release lines through APSB26-73. The patched builds are labelled 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul for Magento Open Source, with Adobe Commerce also covering 2.4.5 and 2.4.4. If you are on an older line than those, there is no official patch for you, and an upgrade plan is overdue.
What to do this week
- Check your version. Confirm you are on one of the July 2026 builds listed in APSB26-73, or apply the patch for your release line.
- Block the upload folder. Make sure your web server denies all access to
pub/media/custom_options/. Sansec's page has Nginx and Apache examples. On Nginx, the rule must come before the PHP location block. - Look for past uploads. Patching stops new uploads but doesn't remove files that are already on disk. List everything in
pub/media/custom_options/; any .php, .phtml or .phar file there is a strong sign of compromise. - Search for the backdoor. Run a recursive search for
accesson.phpacross the document root, and check CMS pages and static blocks for unfamiliar script tags. - Consider a WAF rule. Blocking the folder doesn't stop the upload request itself. A web application firewall rule on the guest cart item endpoints does.
If you find anything, treat it as a full incident: rotate admin and API credentials and get a security specialist to review the server.
A note on third-party extensions
PolyShell is a reminder that every module talking to your store through the REST API widens what you need to trust. Before you add any extension that touches carts or customer data, including a chat assistant, it's worth asking how it authenticates and what it can write. Our chat widget security checklist lists seven questions to ask any vendor, us included.
Sources: CISA alert, 27 October 2026, Adobe APSB26-73, Sansec PolyShell research.