Adobe Commerce and Magento flaw lets attackers upload files without logging in, CISA lists it as exploited

On 27 October 2026 the US agency CISA added CVE-2026-48356 in Adobe Commerce and Magento Open Source to its catalogue of known exploited vulnerabilities. An attacker can use the REST interface to upload a file that pretends to be an image, and needs no login to do so. The fix has been available since 14 July 2026, so the main task now is not patching but checking whether anything was left behind in the store.

Finding card based on Adobe bulletin APSB26-73 and the CISA KEV catalogue.

What happened

Adobe Commerce and Magento Open Source are platforms for running online stores. CVE-2026-48356 is an unrestricted upload of a file of a dangerous type: the store accepts a file it should have rejected. Sansec, an e-commerce security company that found the flaw and named it PolyShell, describes an upload through the store REST interface without logging in, with the file disguised as an image. Whether the uploaded file then runs as code depends on the web server configuration, according to Sansec. Even where the server blocks execution, the file stays on disk.

Adobe rates the flaw critical. Bulletin APSB26-73 gives it CVSS 9.6, while the CVE record and the NVD database give 9.3; the sources differ only in the availability impact. Both vectors agree that the attacker needs no privileges but does need user interaction, meaning someone has to open a prepared address or a compromised page.

Sansec has described exploitation since March 2026, before the fix for production release lines was available. In a wave on 30 March 2026, according to Sansec, attackers uploaded web shells (a script that lets an attacker run commands over the web) and injected third-party JavaScript into store pages. On 24 October 2026 Sansec linked PolyShell to a campaign that has hit 953 stores since July 2025, most of them on Magento, and that inserts a loader for external code into the static CMS blocks of the store. Sansec found the newest version of the loader in the CMS blocks of 83 stores, 60 of which already ran an older version from the same campaign. According to Sansec the loader recognises security scanners and does not answer them, so a routine scan may find nothing. Sansec has not captured the final malicious payload of the campaign yet.

In its bulletin, last updated on 11 August 2026, Adobe still states that it is not aware of exploitation of the issues it fixes. That sentence predates the CISA listing, where exploitation is marked as active.

Does this affect you?

According to bulletin APSB26-73 the affected versions are:

• Adobe Commerce 2.4.9 and 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18 and earlier,
• Adobe Commerce B2B 1.5.3 and 1.5.2-p5, 1.4.2-p10, 1.3.4-p17 and 1.3.3-p18 and earlier,
• Magento Open Source 2.4.9 and 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15 and earlier.

You can find the store version in the installation root with bin/magento --version. The version number alone is not enough: Adobe shipped the fix as the 2026-jul isolated patch level on top of the base release, not as a new -pN release. Ask whoever runs the store whether the 2026-jul patch is deployed.

If an external agency or a hosting provider operates the store, there are three questions for them: whether the July patch is deployed, when that happened and what the check of the store found. For organisations under European security regulation this is exactly the kind of question that belongs in supplier management.

What to do now

• Deploy the 2026-jul isolated patch as described in bulletin APSB26-73: Adobe Commerce and Magento Open Source in versions 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul and 2.4.4-2026-jul, Adobe Commerce B2B in versions 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul and 1.3.3-2026-jul. Isolated patches apply only to the highest patch level of each release line, so the base version may need to be brought up first.
• If you use Adobe Commerce Events, move to version 1.21.0 as the bulletin advises.
• Until the patch is in place, restrict write requests to the guest cart REST interface on the web server or on the protective layer in front of it. According to Sansec this was the entry route and the GraphQL interface is not affected. Also block execution of PHP code in the pub/media directory: it makes the attack harder, but the uploaded file still stays on disk.
• After patching, change the passwords of administrator accounts and end their sessions. The patch removes nothing that an attacker managed to upload or write to the database.
• While you are at it, check the PHP version the store runs on. We covered the critical flaws from 21 October 2026 in a separate article on the CypherOn blog.

How to tell whether you are already compromised

The indicators come from research by Sansec:

• files in the pub/media/custom_options/quote/ directory that pretend to be images and contain PHP code,
• foreign code in the cms_block and cms_page tables, meaning an injected script or a call to an external domain. According to Sansec, the loader from this campaign never appeared in the core_config_data table or in theme files,
• write requests to the guest cart REST interface in the web server log from the period before the patch was deployed.

If you find a foreign script, deleting it is not enough. Sansec points out that an attacker who managed to write to the store database still has that access. In that case treat it as an incident: preserve the logs and a copy of the data, review administrator accounts and establish what else was written to the database.

No time to track this?

Watching vulnerabilities in the products a company actually uses is daily work, and in smaller teams it is the first thing to be postponed. We help with that in two ways. A security assessment shows what you have exposed to the internet and how your patching is set up. As an external security manager we keep track of it continuously. If you are dealing with an attack right now, the incident response page is faster. The initial consultation is free of charge, you can reach us through contact.

Sources: Adobe, bulletin APSB26-73 with the fix and the version list · CISA, catalogue of known exploited vulnerabilities · NVD, record for CVE-2026-48356 · Sansec, campaign with a loader in CMS blocks · The Hacker News, the CISA listing of the flaw