CVE-2026-48356PolyShell: Adobe Commerce / Magento unrestricted file upload (CVE-2026-48356)

Executive summary

CVE-2026-48356 is an unrestricted upload of a file with dangerous type (CWE-434) in Adobe Commerce and Magento Open Source, rated Critical with CVSS 9.6 in Adobe bulletin APSB26-73. Sansec, which named the bug PolyShell, describes unauthenticated uploads of polyglot files that pass as images through the guest-cart REST API custom-option handling, with files landing in pub/media/custom_options/quote/.

Sansec reports in-the-wild attacks from 2026-03-19 and mass waves hitting a large share of the stores it monitors in late March and April, months before Adobe backported the fix to supported release lines on 2026-07-14 (APSB26-73). Sansec's 2026-10-24 research links PolyShell webshells to a long-running campaign injecting JavaScript loaders into Magento cms_block content.

CISA added the CVE to KEV on 2026-10-27 with a federal due date of 2026-11-10. Stores that patched late should assume possible compromise: patching does not remove webshells, backdoors or injected CMS blocks.

Threat assessment

This is an established, commodity attack against e-commerce. Sansec documents probing from 2026-03-16, more than 50 scanning IPs, and webshell uploads such as accesson.php planted under assets/images/ in several top-level directories. The follow-on objective in the campaign Sansec tracked is persistent client-side injection via cms_block loaders (Keitaro traffic distribution, browser fingerprinting via deepveindrilling.com), which Sansec says reached 953 stores since July 2025.

Adobe's bulletin (last updated 2026-08-11) still states that Adobe is not aware of exploits in the wild, which conflicts with Sansec's reporting and the KEV listing. SOC teams should rely on KEV and Sansec, treat any unpatched or late-patched Magento instance as potentially compromised, and include the related SessionReaper flaw (CVE-2025-54236, APSB25-88) in the same hunt, as Sansec found stores with uploads via either flaw.

Timeline

1. 2026-10-27

   CISA adds CVE-2026-48356 to the KEV catalog, due date 2026-11-10. Source

2. 2026-10-24

   Sansec reports deepveindrilling.com cms_block loaders on 83 stores and links earlier injection waves to PolyShell webshells. Source

3. 2026-08-11

   Adobe updates APSB26-73; bulletin still states no known exploits in the wild. Source

4. 2026-07-14

   Adobe releases APSB26-73 with 2026-jul isolated patches for supported release lines. Source

5. 2026-05-12

   Magento 2.4.9 released with the fix, initially without backports to 2.4.8 and earlier (per Sansec). Source

6. 2026-03-30

   Mass attack wave targets 79.5% of Sansec-monitored stores. Source

7. 2026-03-19

   Sansec observes first PolyShell attacks in the wild. Source

8. 2026-03-17

   Sansec publishes its PolyShell research. Source

Affected & exposure

Adobe Commerce 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier; 2.4.5-p17 and earlier; 2.4.4-p18 and earlier

Adobe Commerce B2B 1.5.3; 1.5.2-p5 and earlier; 1.4.2-p10 and earlier; 1.3.4-p17 and earlier; 1.3.3-p18 and earlier

Magento Open Source 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier

Adobe Commerce Events 1.6.0 to 1.20.0 (fixed in 1.21.0)

Vulnerable endpoints per Sansec: POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId (no authentication); GraphQL mutations not affected

Exploitation in the wild

CISA added CVE-2026-48356 to KEV on 2026-10-27 as "Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability", due date 2026-11-10.

Sansec: initial probing 2026-03-16, first attacks 2026-03-19, mass scanning from 2026-03-23, a wave on 2026-03-30 targeting 79.5% of monitored stores and malicious uploads on 82% of stores by 2026-04-14.

Sansec (2026-10-24): the deepveindrilling.com loader was found in CMS blocks of 83 stores; the March mass wave injected the loader into 471 stores in one hour after webshells were uploaded via PolyShell; the October loader rewrites used no new vulnerability.

Documented artefacts (Sansec): uploaded files such as index.php, option-ID-prefixed names, json-shell.php, bypass.phtml, rce.php; the accesson.php backdoor that always prints 8194460; localStorage key fpCode in injected scripts.

Detection & hunting

Hunt for unauthenticated POST/PUT requests to the guest-cart items REST endpoints carrying file-upload custom options, any request for executable files under media/custom_options/, requests for accesson.php, and new PHP-like files written below pub/media/. On the database side, Sansec recommends querying cms_block and cms_page for fpCode, se_referrer or localStorage.getItem and auditing admin_user for unknown accounts.

index=web (sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=*access*)
(
  (http_method IN ("POST","PUT") uri_path="*/V1/guest-carts/*/items*")
  OR uri_path="*/media/custom_options/*"
  OR uri_path="*/media/customer_address/*"
  OR uri_path="*accesson.php*"
)
| eval suspicious_exec=if(match(uri_path, "(?i)/media/(custom_options|customer_address)/.*\.(php\d?|phtml|phar)") OR match(uri_path, "(?i)accesson\.php"), 1, 0)
| stats count AS requests sum(suspicious_exec) AS exec_hits values(uri_path) AS paths values(status) AS statuses BY src_ip, http_method
| sort - exec_hits, - requests

DeviceFileEvents
| where Timestamp > datetime(2026-03-01)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has_any ("/pub/media/custom_options/", "/pub/media/customer_address/") or FileName =~ "accesson.php"
| where FileName !~ ".htaccess"
| where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".phar" or FileName =~ "accesson.php"
| project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

title: Request to Executable File in Magento Upload Directory (possible PolyShell CVE-2026-48356)
status: experimental
description: Detects web requests for PHP-like files under media/custom_options or media/customer_address, or for the accesson.php backdoor documented by Sansec.
references:
  - https://sansec.io/research/magento-polyshell
  - https://www.adobe.com/trust/security/products/commerce/apsb26-73.html
logsource:
  category: webserver
detection:
  selection_upload_dir:
    cs-uri-stem|contains:
      - '/media/custom_options/'
      - '/media/customer_address/'
  selection_exec_ext:
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  selection_backdoor:
    cs-uri-stem|endswith: '/accesson.php'
  condition: (selection_upload_dir and selection_exec_ext) or selection_backdoor
falsepositives:
  - Unlikely; legitimate Magento installs do not serve PHP from these directories
level: high
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1190
  - cve.2026-48356

Mitigation

• Apply APSB26-73 (the 2026-jul isolated patches for Adobe Commerce 2.4.4 to 2.4.9, B2B 1.3.3 to 1.5.3 and Magento Open Source 2.4.6 to 2.4.9) and upgrade Adobe Commerce Events to 1.21.0 or later.
• Block web access and PHP execution for pub/media/custom_options/ before any PHP handler (Nginx location deny; Apache .htaccess disabling the PHP engine). Sansec notes this stops execution, not uploads, so remove files already on disk.
• Hunt for compromise even after patching: list files in pub/media/custom_options/ and pub/media/customer_address/ (excluding .htaccess), search for accesson.php and PHP tags under pub/media/, query cms_block and cms_page for injected loaders, and audit admin_user.
• If compromise is found, remove backdoors and injected blocks, then rotate database, admin and API integration credentials (Sansec). Also apply the SessionReaper fix APSB25-88.
• Where patching is delayed, use a WAF rule that blocks the vulnerable guest-cart file-upload API calls (Sansec).

Update log

Sources

1. Adobe Security Bulletin APSB26-73: Adobe Commerce
2. CISA Known Exploited Vulnerabilities Catalog
3. Sansec: PolyShell, unrestricted file upload in Magento and Adobe Commerce
4. Sansec: Magento cms_block loader deepveindrilling
5. Corgea: CISA adds Adobe Commerce and Magento PolyShell (CVE-2026-48356) to KEV
6. Wiz vulnerability database: CVE-2026-48356