Magento PolyShell CVE-2026-48356: KEV and webshell hunt

ALERT · Actively exploited. Last updated 27 October 2026. See the Alert Tracker

If you run Magento Open Source or Adobe Commerce on the internet, patch to the APSB26-73 builds and hunt for webshells under pub/media/custom_options/ and for any accesson.php elsewhere in the tree. CVE-2026-48356 is an unauthenticated file upload on guest-cart custom options. CISA listed it as known exploited today. Public research nicknames the chain PolyShell.

What it is

CVE-2026-48356 (opens in a new tab) is an unrestricted upload of a file with a dangerous type (CWE-434) in Adobe Commerce and Magento Open Source. Adobe rates it Critical (Adobe CVSS 3.1: 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L). NVD scores it 9.3 with no availability impact (NVD CVSS 3.1: 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). No authentication is required. The REST cart custom-options path accepts a base64 file_info object for file-type product options; critical checks are missing, so a polyglot (image plus PHP) can be written under pub/media/custom_options/quote/.

Adobe published the fix in bulletin APSB26-73 (opens in a new tab) on 14 July 2026. At publication Adobe said it was not aware of exploits in the wild for the issues in that bulletin. On 27 October 2026 CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities catalogue (opens in a new tab) with required action under BOD 26-04 and a due date of 10 November 2026. Sansec’s public PolyShell research (opens in a new tab) describes in-the-wild use: polyglot drops in the upload directory, a sprayed accesson.php backdoor under many assets/images/ paths, and an obfuscated JavaScript loader injected into Magento CMS pages or static blocks.

Who is affected

Per APSB26-73, affected lines include Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, and 2.4.4-p18 and earlier; Magento Open Source 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, and 2.4.6-p15 and earlier; and listed Adobe Commerce B2B packages. Updated builds are the *-2026-jul releases (for example 2.4.8-2026-jul). Internet-facing stores that still accept guest-cart custom file options without the July patch are the immediate priority.

How to find it in your estate

Inventory Magento Open Source and Adobe Commerce versions against APSB26-73. On every store root, search for PHP under the custom-options upload path and for the secondary backdoor name Sansec published:

find /path/to/magento -path '*/media/custom_options/*' \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \)
find /path/to/magento -name 'accesson.php'

Also review CMS pages and static blocks for script tags that fetch from external loader hosts. Sansec names three defanged examples tied to this campaign: lanhd6549tdhse[.]top, jslibrary[.]net, and canevaslab[.]com. Treat those as starting points, not a complete blocklist.

For continuous hunting we drafted two Sigma file_event rules (PHP under */media/custom_options/, and any path ending in accesson.php) with KQL, ES|QL and Splunk conversions. See the Hunt Lab folder (opens in a new tab). Companion: CMS loader domains hunt.

What to do

  1. Apply the APSB26-73 updated builds for your line, then restart PHP-FPM / the web stack.
  2. Until patched, ensure the web server cannot execute PHP (or equivalents) under pub/media/custom_options/. Adobe’s bulletin and Sansec both stress upload-directory execution blocks; do not treat that alone as a substitute for the patch.
  3. Hunt and remove webshells and accesson.php copies; rotate Magento admin and integration credentials; review recent CMS/block edits.
  4. Federal civilian executive branch agencies: meet the KEV due date of 10 November 2026 and follow BOD 26-04 guidance linked from the KEV notes.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)