CISA Adds Magento PolyShell Upload Flaw CVE-2026-48356 to KEV: Fixed Builds and How to Hunt for Webshells

CISA added CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento Open Source, to its Known Exploited Vulnerabilities catalog on 27 October 2026. Federal agencies must remediate by 10 November. Sansec calls the flaw PolyShell. Any store on an unpatched 2.4.x branch is exposed, and stores that were open during the spring attack waves may already be compromised.

What happened

Adobe fixed the flaw in bulletin APSB26-73 on 14 July 2026. It rates the issue Critical, Priority 2, CWE-434. The CVE record, scored by Adobe and matched by NVD, gives CVSS 3.1 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N); the bulletin page lists 9.6. That vector assumes user interaction, while Sansec describes exploitation without login or user action.

The timeline is older than the patch. Sansec says probing began on 16 March, the first attacks hit on 19 March, and a mass wave on 30 March compromised 471 stores in one hour. Sansec's account is that Magento 2.4.9 (12 May) carried a fix, and APSB26-73 backported it to older lines on 14 July. The KEV listing marks ransomware use as Unknown.

Attackers hit the Magento upload flaw 54 days before Magento 2.4.9 shipped a fix; CISA listed it on KEV only in late October.

Technical detail

The entry point is the unauthenticated REST API: POST /V1/guest-carts/:cartId/items and PUT on the item endpoint. A cart item custom option of type "file" accepts a base64 file_info object, and the file lands in pub/media/custom_options/quote/. Sansec says option ID validation, option type gating and extension restrictions are all missing. Only an image header check remains, which a polyglot file (image header plus PHP) passes. GraphQL uses a different path and is not affected.

Whether an upload runs depends on the web server. Sansec cites a non-standard nginx setup that executes any .php file, and Apache before 2.3.5.

In the March wave, the first-stage shell dropped accesson.php backdoors into assets/images/ folders under many top-level directories, then injected obfuscated JavaScript into CMS pages and static blocks. The loader, which pulled from lanhd6549tdhse.top, fingerprinted visitors and can support checkout card skimming.

Fixed builds

Patches ship as individual ZIPs, not Composer packages. Bring the store to its branch's latest security release first (2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18), then apply:

B2B fixes are 1.5.3, 1.5.2, 1.4.2, 1.3.4 and 1.3.3, each with the -2026-jul suffix. Adobe Commerce Events is fixed in 1.21.0. Open Source on 2.4.5 or earlier needs an upgrade.

What defenders should do

1. Apply the July patch, including on 2.4.9.
2. Hunt for uploads: find pub/media/custom_options/ -type f ! -name '.htaccess'. Any .php, .phtml or .phar file is a strong compromise sign.
3. Find backdoors: find /var/www -name 'accesson.php' -type f. Also check names such as 780index.php, bypass.phtml, c.php, rce.php and test.php.
4. Search cms_block and cms_page for lanhd6549tdhse[.]top, jslibrary[.]net, canevaslab[.]com and localStorage, and check update_time against maintenance dates.
5. Review access logs for POST or PUT to guest-cart item endpoints, especially file-type options on products with no file option.
6. Until patched, deny web access and PHP execution under pub/media/custom_options/ (nginx deny before the PHP location; Apache php_flag engine 0 and Deny from all) and confirm a 403. This does not stop uploads.
7. If you find anything, treat it as an incident: rotate admin and API credentials and review admin users. Patching does not remove an existing foothold.

Sansec warns that these indicators change and a clean search does not prove a clean store.

For another exploited Commerce flaw, see our coverage of CVE-2026-71362.

Sources

• Adobe APSB26-73
• CISA KEV feed
• Sansec PolyShell advisory
• Sansec mass attack wave
• Issoh summary