Design Partner Program
TLP:CLEAR SECURITY ADVISORY HRK-SA-2026-1028-04 Exploited in the wild

Adobe Commerce PolyShell (CVE-2026-48356): unauthenticated file upload to code execution

A polyglot file passes the storefront's image check and still runs as PHP. Adobe fixed it in July, CISA added it to KEV in October, and a store patched late can already carry a web shell the patch does not remove. Install the July 2026 release, then hunt for what was left behind.

SEVERITY
Critical
PEAK CVSS
9.6
AUTH REQUIRED
None
PUBLIC POC
Yes
PUBLISHED
Oct 28, 2026
REVISION
v1.0 · @Melly
01 · EXECUTIVE SUMMARY

Bottom line

Hayrok Research Lab is tracking a critical, unauthenticated file upload flaw in Adobe Commerce and Magento Open Source. Adobe fixed it in July 2026, but CISA added it to KEV on Oct 27 with evidence of active exploitation. A store on the July release is patched; a store patched late can still carry a backdoor planted before the fix. Install the release, then hunt media and upload folders for web shells.

KEY JUDGMENTS
01
CISA added CVE-2026-48356 to its KEV catalog on Oct 27, 2026, with a federal remediation deadline of Nov 10. Public exploit code exists.Observed
02
The patch closes the upload path but does not remove a web shell already on disk. Patched stores still need a compromise hunt.Assessed
03
Impact depends on the web server config: code execution where the server runs PHP from media folders, stored XSS and takeover where it does not.Assessed
04
Forgotten staging stores are a common entry point: often public, rarely patched, same data.Reproduced
02 · VULNERABILITY DETAILS

Vulnerability summary

Adobe Commerce custom options file upload RCE
CVE-2026-48356 NVD
9.6Critical
Linked to
The PolyShell attacks tracked by Sansec (not confirmed by Adobe)
Component
Custom options upload path, REST API
Weakness
CWE-434 unrestricted upload of a file with a dangerous type
Affected
2.4.4 to 2.4.9 before the July 2026 release
Scoring
9.6 · CVSS v3.1
Fix
Adobe security bulletin APSB26-73, July 14, 2026
Impact
Code execution as the web server user, and a foothold for card skimming.
EXPOSURE: TWO THINGS MUST BE TRUE
01Missed or late patchStore not on the July 2026 release, or patched after attacks began.
02Reachable upload pathThe custom options REST API on a public storefront.
03PHP runs from mediaThe web server executes PHP under pub/media.
04Prior compromiseA shell may already be present on a late-patched store.
03 · THREAT ACTIVITY

Exploitation status and timeline

IN THE WILDObservedCISA KEV Oct 27, deadline Nov 10.
PUBLIC POCAvailableExploit code on GitHub since Sep 26.
PATCHAvailableAPSB26-73 shipped Jul 14.
RESIDUAL RISKWeb shellsPatch does not remove dropped files.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Mar 16Sansec sees the first PolyShell probes against Magento stores.
Mar 30Sansec reports 471 stores compromised in a single hour.
Jul 14Adobe publishes APSB26-73, fixing CVE-2026-48356 on all supported lines.
Sep 26Public exploit code for the file upload flaw appears on GitHub.
Oct 27CISA adds CVE-2026-48356 to KEV, with a federal deadline of November 10.
04 · AFFECTED PRODUCTS

Affected and fixed versions

Version alone does not settle risk. A store on the July release is patched, but a store patched late may already hold a web shell the update does not touch.

PRODUCT
AFFECTED
FIXED IN
STATUS
Adobe Commerce
2.4.4 to 2.4.9 pre July
July 2026 release for your line
Fixed
Adobe Commerce B2B
1.3.3 to 1.5.3 pre July
July 2026 B2B release
Fixed
Magento Open Source
matching lines pre July
July 2026 release
Fixed
End of support lines
all
None. Upgrade
No fix
CONFIG MATTERSAdobe ships a sample web server configuration that refuses to run PHP from media folders. Many stores run a custom host configuration that does not. Confirm yours.
05 · RECOMMENDED ACTIONS

What to do, in priority order

CriticalImmediately
Stores not on the July releaseApply the July 2026 release for your line now, then hunt for web shells.
Stores patched after SeptemberAssume possible prior compromise. Run the web shell hunt before anything else.
HighWithin 72 hours
Cloud and staging environmentsCheck and patch each environment, not just production.
End of support linesPlan migration to a supported line. No fix exists for them.
Media folder executionBlock PHP execution under pub/media at the web server.
HighBefore closing
Every storefrontRecord the version, the shell-hunt result and the media execution test as evidence.
WORKAROUNDS
Block media execution. The web server should never run PHP from pub/media. Deny PHP requests under the media path.Lock the upload folder. Deny public access to pub/media/custom_options/.Filter the API. Put a tested WAF rule in front of the REST API that blocks uploads carrying executable content.Keep hunting. Blocking access does not remove files that already landed. Keep looking for new files.
06 · DETECTION AND HUNTING

Observables and hunting queries

No stable file hashes are published for the dropped shells. Hunt for unexpected scripts under media and for the upload-then-request pattern in logs.

TYPE
OBSERVABLE
SOURCE
File
A PHP, phtml or phar file under pub/media
Filesystem on each storefront
File
An image file that also contains
Filesystem on each storefront
Request
A REST cart upload followed by a request to a new media file
Web server access logs
HUNT · PolyShellscripts under the media folder
find pub/media -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \)
HUNT · PolyShellpolyglot images hiding code
grep -rl '<?php' pub/media --include='*.gif' --include='*.png' --include='*.jpg'
07 · MITRE ATT&CK

Technique mapping

TACTIC
ID
TECHNIQUE
BASIS
Initial Access
T1190
Exploit Public-Facing Application
Observed
Persistence
T1505.003
Server Software Component: Web Shell
Observed
08 · TECHNICAL ANALYSIS

Root cause and attack path

Magento lets a shopper attach a file to a cart item as a custom option through the REST API. That path validates that the file looks like an image, checking image markers rather than what else the file contains. A polyglot is a single file that is simultaneously a valid GIF or PNG and valid PHP. It satisfies the image check and keeps its code.

The file is written under pub/media, a folder meant for static assets. Where the web server is configured to run PHP there, the uploaded file executes when requested, giving a web shell. That is the unrestricted file upload, CWE-434. Sansec reports common payloads use a cookie as a password, so the shell looks like a broken image to anyone else.

01 UPLOAD
Polyglot attached to a cart via the REST API
Control: WAF rule on executable upload content
02 PASS
The image check passes, the file lands in pub/media
Control: Lock pub/media/custom_options/
03 EXECUTE
The server runs PHP from the media folder
Control: Block PHP execution under pub/media
04 PERSIST
The attacker requests the file and gets a web shell
Control: Patch to the July release, hunt shells
RELATED CVES
n/a Related
An earlier Adobe Commerce flaw. Track alongside, but its fix does not cover CVE-2026-48356.
AssessedPatching in July did not end the exposure. A store patched after attacks began can still serve a web shell planted before the fix.
09 · VALIDATION

Confirm remediation

A version number is not a verdict. Each store should end with a result: patched and clean, patched with findings, or exposed.

01
Confirm the version on every store
Include staging and headless backends.
bin/magento --version
composer show | grep -E 'magento/product|adobe-commerce'
02
Hunt for web shells
Look for PHP where none should exist, and images that hide code.
find pub/media -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \)
grep -rl '<?php' pub/media --include='*.gif' --include='*.png' --include='*.jpg'
03
Test the execution path, in scope
A request for a test PHP file under media should return text or 403, never execute.
nginx -T 2>/dev/null | grep -n -A3 'location.*media'
04
Test the upload and the alert
Attempt a harmless dangerous-type upload through the REST API in an approved scope.
# approved test only: harmless file with a dangerous type via the custom options API
05
Confirm monitoring
Confirm a new PHP file in a media folder raises an alert.
# verify the file-integrity alert fires on a new media script
10 · EXPOSURE SELF-ASSESSMENT

Am I exposed?

CVE-2026-48356
01Is any storefront or staging copy not yet on the July 2026 release (APSB26-73)?
02Was any store patched after attacks began in September, so a shell may predate the patch?
03Does the web server run PHP from pub/media on any store?
04Have you hunted media and upload folders for unexpected PHP or polyglot files?
ANSWER TO SEE A VERDICT
Pick yes, no or not sure for each question.
11 · REFERENCES AND REVISION HISTORY
References
›Adobe security bulletin APSB26-73
›CISA: Adds two known exploited vulnerabilities, Oct 27, 2026
›Sansec: PolyShell research
›Sansec: Mass PolyShell attack wave
Revision history
1.0Oct 28, 2026Initial publication.

This advisory will be updated as exploitation activity or vendor guidance changes.

12 · FAQ
Is CVE-2026-48356 being exploited?

Yes. CISA added it to the KEV catalog on October 27, 2026, with a federal deadline of November 10.

Is CVE-2026-48356 the same as PolyShell?

Several outlets link them, and both are file upload flaws in the same platform. Adobe has not confirmed the link. The checks here cover both.

I patched. Am I safe?

Only if no web shell was planted before you patched. The update does not remove files already on disk. Hunt the media folders.

Which update fixes it?

Adobe security bulletin APSB26-73, the July 2026 release for each supported line.

VALIDATE YOUR EXPOSURE

Prove your store is clean

Hayrok maps your storefronts, attempts a harmless upload through the REST API, and checks whether the web server will run PHP from media. Every result lands in Evidence Fabric.

Book a technical session → Apply to the Design Partner Program
At Hayrok Labs we question everything and Validate what matters.