PolyShell Magento Vulnerability (CVE-2026-48356): Patch Now

PolyShell is the name the security firm Sansec gave to CVE-2026-48356, a critical file upload vulnerability in Magento Open Source and Adobe Commerce. On 27 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog, which it does when it has evidence of exploitation in the wild, and gave US federal civilian agencies until 10 November 2026 to fix it. Adobe fixed the flaw in security bulletin APSB26-73, published on 14 July 2026. If your store has not installed that July update, treat it as urgent and check it for signs of compromise as well.

What is the PolyShell vulnerability?

Adobe's bulletin lists CVE-2026-48356 as an unrestricted upload of a file with a dangerous type (CWE-434), rated critical with a CVSS 3.1 base score of 9.6; NVD lists the same flaw at 9.3. Adobe says no authentication is needed to exploit it and gives the impact as privilege escalation. Its CVSS vector includes user interaction, and the NVD entry describes an attack that needs a victim to visit a crafted URL or a compromised page.

Sansec, which named PolyShell, says the flaw lets attackers upload executable files through Magento's REST API, using a polyglot file that is code disguised as an image to get past validation. Whether that file can then run depends on the web server configuration; Sansec says that even when execution is blocked, the uploaded file stays on disk.

Which Magento and Adobe Commerce versions are affected?

These are the affected versions and the updates that fix them, exactly as Adobe names them in APSB26-73:

Note that 2.4.9 itself is listed as affected, so a store on 2.4.9 still needs the 2.4.9-2026-jul update. Sansec says 2.4.9, released on 12 May 2026, already contained the fix; follow Adobe's list and install 2.4.9-2026-jul. APSB26-73 also fixes thirteen other vulnerabilities, including CVE-2026-48358, a critical code execution flaw that Adobe says applies to webhooks only. Adobe's bulletin, last updated on 11 August 2026, says Adobe was not aware of exploits in the wild for any of these issues; CISA's listing on 27 October shows that has changed for PolyShell.

PolyShell timeline

How to check if your Magento store is compromised

Patching closes the hole but does not remove anything already uploaded. Sansec publishes these checks and indicators of compromise:

• List files in the custom options upload directory: find pub/media/custom_options/ -type f ! -name '.htaccess'. Sansec says any .php, .phtml or .phar file there is a strong indicator of compromise.
• Search the whole document root for the backdoor file Sansec has seen in these attacks: find /var/www -name 'accesson.php' -type f.
• Check CMS pages and static blocks for scripts loaded from domains you do not recognise. Sansec's PolyShell post names lanhd6549tdhse.top, and its October report names deepveindrilling.com. The October report says deleting the script does not remove the attacker's access.

If you find any of these, treat the server as compromised: keep a copy of the evidence, then rotate admin, API, database and payment credentials once the clean-up is done.

How to patch PolyShell

1. Confirm your version. Run bin/magento --version on every environment, including staging and any server that still answers on an old hostname.
2. Install the July 2026 update for your line. Use the version for your release line from the table above and follow the release notes linked from APSB26-73. Adobe recommends updating to the newest version.
3. Update B2B and Events too. Adobe Commerce B2B merchants need the matching B2B update, and Adobe Commerce Events needs 1.21.0.
4. Check for compromise. Run the checks above before and after patching, because an earlier upload survives the update.

Older lines have limited time left. Adobe's lifecycle policy puts 2.4.4 and 2.4.5 in a one-time security-only transitional period with limited isolated security fixes until 31 May 2027, and 2.4.6 enters it after extended support ends on 31 August 2027. Adobe tells merchants to treat this period as migration time.

Does PolyShell affect Shopify or BigCommerce stores?

No. CVE-2026-48356 is in Magento Open Source and Adobe Commerce code, which Shopify and BigCommerce stores do not run. Magento is a PHP application, though, so a self-hosted Magento server also needs the PHP fixes from our PHP2Shell post.

What to do next

Install the APSB26-73 update today, run the compromise checks and rotate credentials if anything turns up. If repeated Magento patching is the real problem, our guides to Magento upgrade cost versus replatforming and Magento alternatives set out the options, and our Magento to Shopify migration team can plan the move.