PolyShell Magento Flaw Under Attack: Steps for Online Stores

The PolyShell flaw (CVE-2026-48356) in Magento Open Source and Adobe Commerce is now officially listed as exploited. CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026. Store operators should install Adobe’s -2026-jul release or a newer one, then check whether their servers have already been compromised.

What happened to Magento and Adobe Commerce

Magento is PHP-based e-commerce software used by retail brands, distributors and B2B sellers to run catalogs, shopping carts and checkout. The free edition is Magento Open Source, and Adobe sells the commercial edition as Adobe Commerce.

Researchers at Sansec, a Dutch e-commerce security firm, named the bug PolyShell and disclosed it on March 17, 2026. The weakness sits in the REST API for guest shopping carts, the path used by shoppers who have not signed in. Through it, an attacker with no account can upload a file that passes as an image while actually carrying PHP code. Files built to be valid in two formats at once are known as polyglots, which gave the flaw its name.

The impact depends on how the server is configured. According to Sansec, if the web server executes PHP files in the upload folder, the attacker gets a webshell, a backdoor for running commands on the store’s server. On other setups the flaw can be used for stored XSS, where a malicious script is saved on the site and runs in visitors’ browsers. Sansec identified two abused endpoints, POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId, and said the GraphQL path is not affected.

Adobe scores the flaw 9.6 on CVSS 3.1 in bulletin APSB26-73, while the NVD entry lists 9.3. Both ratings are critical. Adobe classifies it as an unrestricted file upload (CWE-434) that requires no authentication.

Affected and fixed versions

Adobe fixed the flaw in APSB26-73, published July 14, 2026. At the time, Adobe said it was not aware of any exploitation. The fixed builds use a newer naming scheme that ends in the release month, such as 2.4.8-2026-jul.

According to Adobe’s bulletin:

• Adobe Commerce is affected in 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and every earlier build in each line. Fixed releases are 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul and 2.4.4-2026-jul.
• Magento Open Source is affected in 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier builds. Fixed releases are 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul.
• Adobe Commerce B2B is affected in 1.5.3 and earlier builds in each line, with fixed releases ending in -2026-jul. The Adobe Commerce Events module, versions 1.6.0 through 1.20.0, is fixed in 1.21.0.

The July release is no longer the newest one. On October 13, 2026, Adobe published APSB26-153, with -2026-oct releases covering 11 other vulnerabilities. That bulletin also asks customers to apply the hotfix for CVE-2026-75650 from APSB26-146 (September 7, 2026) on top of it. Stores that have yet to update should therefore go straight to the -2026-oct release for their line. The October list for Magento Open Source covers only the 2.4.7 to 2.4.9 lines, so stores on 2.4.6 should check the support status of that line on Adobe’s site.

Version 2.4.9, released in May 2026, is also listed as affected in Adobe’s bulletin. Stores already on 2.4.9 still need 2.4.9-2026-jul or later.

Exploitation status

Attacks were under way long before CISA acted. Sansec says it has blocked PolyShell attack attempts since March 16, 2026. On March 30, 2026, it recorded 471 stores compromised within a single hour. The attackers uploaded webshells, planted a backdoor named accesson.php and then injected a JavaScript loader into the stores’ CMS content.

On October 24, 2026, Sansec published a follow-up report on the same campaign. Since July 2025 it has infected 953 stores, most of them running Magento. The loader is stored in the cms_block table, the part of the database that holds reusable page content. It checks whether a visitor is a real shopper or a security scanner and serves its payload only to shoppers. The Hacker News and SecurityWeek reported the findings on October 26.

The report also carries a warning for stores that believe they are safe. One store on Magento 2.4.7-p10, which Sansec described as having no missing core patches, still received the loader an hour after a clean scan. That store had earlier shown a rogue admin account and a backdoor. Patching closes the door to new uploads, but it does not remove an intruder who is already inside.

The CISA KEV catalog sets a November 10, 2026 remediation deadline for US federal civilian agencies. The deadline does not bind companies in Indonesia, but CISA urges every organization to prioritize vulnerabilities in the catalog.

What this means for retailers

Online stores hold exactly the data attackers want: names, addresses, phone numbers, order history and payment pages. A script injected into checkout can read what shoppers type without the store owner noticing. Retail brands and distributors that run Magento themselves should work through the following steps this week.

1. Check the version. Compare your Magento or Adobe Commerce version with the list above. It appears in the admin panel footer and in composer.lock.
2. Install a fixed release. At minimum the -2026-jul release for your line, ideally the -2026-oct release plus the CVE-2026-75650 hotfix. Test on a staging copy if you can, but do not let testing stretch into weeks.
3. Lock the upload folder. Sansec recommends blocking web access to pub/media/custom_options/. On Nginx, place a deny all rule for that folder before any .php location block. On Apache, make sure the folder’s .htaccess disables PHP (php_flag engine 0) and includes Deny from all. This limits the damage but does not stop files from being uploaded.
4. Look for signs of compromise. Run find pub/media/custom_options/ -type f ! -name '.htaccess'; any .php, .phtml or .phar file there is a strong sign of intrusion. Also search for accesson.php, inspect the cms_block and cms_page tables for unfamiliar scripts and review the admin_user table for accounts you do not recognize.

If you find anything, treat the store as compromised. Sansec advises removing backdoors and rogue accounts, then changing database, admin and API integration passwords. Magento runs on PHP, so also confirm your PHP version is safe from the bugs covered in our piece on PHP2Shell and fixed PHP versions.

Over the longer term, put the store platform on the same regular update schedule as point-of-sale and warehouse systems. Teams that run retail management systems alongside an online store can fold version tracking, backups and access logs into one monthly checklist.

Frequently asked questions

My store runs Magento 2.4.9 from May. Is it safe?

Not necessarily. Adobe’s bulletin still lists 2.4.9 as affected, and the fixed build is 2.4.9-2026-jul. The newer 2.4.9-2026-oct release also closes the additional flaws in the October bulletin.

The store is already patched. Do I still need to check the server?

Yes. Patching blocks new uploads, but files, admin accounts and scripts planted earlier stay in place. The 2.4.7-p10 case in Sansec’s report shows that intruders can return through access they already hold.

Are stores on SaaS platforms such as Shopify affected?

No. PolyShell concerns only Magento Open Source, Adobe Commerce, Adobe Commerce B2B and the Adobe Commerce Events module. Stores built on other platforms are not affected by this flaw.

Closing thoughts

PolyShell has been used against online stores since March, and CISA’s KEV listing confirms the risk is still active. Check your store’s version, install Adobe’s latest release for your line, lock down the upload folder and look for traces of intrusion before declaring the store clean. If your team needs support auditing an online store, Merakit’s cybersecurity services can help.

Sources

• Adobe Security Bulletin APSB26-73: Security update available for Adobe Commerce (July 14, 2026, updated August 11, 2026)
• Adobe Security Bulletin APSB26-153: Security update available for Adobe Commerce (October 13, 2026)
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 27, 2026)
• NVD: CVE-2026-48356 (updated October 27, 2026)
• Sansec: PolyShell: unrestricted file upload in Magento and Adobe Commerce (March 17, 2026)
• Sansec: Mass PolyShell attack wave hits 471 stores in one hour (March 30, 2026)
• Sansec: deepveindrilling.com: Magento CMS block loader hits 953 stores (October 24, 2026)
• The Hacker News: Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento (October 26, 2026)
• SecurityWeek: 953 Online Stores Infected in Long-Lasting Malware Campaign (October 26, 2026)