Magento PolyShell Vulnerability CISA KEV Explained: 953 Stores Hit, 10 November Deadline and What to Patch
Illustrative image: Wikimedia Commons / Yacàwotçã, CC BY 2.0 — a hand holding a smartphone over an online search. This is a generic online-shopping photo, not a screenshot of an infected store or of Adobe Commerce.
TL;DR — Magento PolyShell vulnerability CISA KEV explained: CISA added the critical Adobe Commerce and Magento file-upload flaw CVE-2026-48356 to its exploited-vulnerabilities list on 27 October 2026, after security firm Sansec linked it to a campaign that infected 953 online stores. US federal agencies must patch by 10 November; every store owner should apply Adobe's APSB26-73 fixes and check for webshells now.
📌 KEY HIGHLIGHTS
- CISA KEV listing (27 Oct 2026): CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento, added to the Known Exploited Vulnerabilities catalog — confirmed active exploitation.
- Severity: CVSS 9.3 (critical). It can lead to arbitrary code execution in the context of the current user.
- Patch deadline: 10 November 2026 for US federal agencies; CISA urges all organisations to prioritise it.
- Real-world damage: Sansec's campaign tracking counts 953 infected online stores, mostly Magento — including 471 injected in a single hour in March 2026.
- The fix: Adobe bulletin APSB26-73 (14 July 2026) — upgrade to the 2026-jul patch levels (e.g. 2.4.9-2026-jul) and hunt for webshells, rogue admins and injected scripts.
Magento PolyShell vulnerability CISA KEV explained: what happened?
On 27 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, the list of flaws with confirmed in-the-wild exploitation. One of them is CVE-2026-48356, the Adobe Commerce and Magento flaw researchers call "PolyShell". The other is a Google Brotli decoder flaw, CVE-2026-111497. This post covers the Adobe flaw, the one that directly threatens online stores and their shoppers.
A KEV listing is not a routine advisory. It means CISA has evidence the flaw is being exploited right now, and it triggers a binding patch deadline — 10 November 2026 — for US federal civilian agencies under Binding Operational Directive 26-04. CISA encourages every other organisation to treat KEV flaws with the same urgency, and says it is unknown whether this flaw has been used in ransomware campaigns.
How PolyShell works: a picture file that is really code
PolyShell, disclosed and named by Dutch security firm Sansec on 17 March 2026, lives in Magento's REST API. When a shopper attaches a file to a product through a "custom option" (for example, uploading a logo for engraving), the API accepts a base64-encoded file. The validator only checks that the file has a valid size and a standard image MIME type — it does not check that the file extension matches the content. An attacker needs no login: a guest cart ID and a product SKU, both easy to obtain, are enough.
The attacker uploads a "polyglot" file: it starts with a valid image header so it passes the check, but the rest is PHP code. Magento writes it to pub/media/custom_options/quote/ on the server. On servers whose web configuration allows that directory to be reached, opening the file runs the code — full remote code execution. Even where execution is blocked, the file sits on disk as a backdoor, and the flaw can also enable stored cross-site scripting and account takeover.
| Fact | Detail |
|---|---|
| CVE | CVE-2026-48356 — unrestricted upload of file with dangerous type ("PolyShell") |
| Products | Adobe Commerce, Adobe Commerce B2B, Magento Open Source, Adobe Commerce Events |
| Severity | CVSS 9.3 (critical); exploitation requires user interaction (visit a malicious URL or compromised page); scope changed |
| KEV listing | 27 October 2026; due date 10 November 2026; ransomware use unknown |
| Fix | Adobe bulletin APSB26-73 (14 July 2026) — 2026-jul patch levels |
| Disclosure | Sansec, 17 March 2026; mass exploitation followed within days |
Illustrative image: Wikimedia Commons / Markus Spiske, CC0 — code on a developer's monitor. A generic tech visual; it is not the PolyShell exploit or any infected store.
953 stores: the campaign behind the listing
The KEV listing did not arrive in a vacuum. Sansec's latest campaign report, covered on 26–27 October 2026, counts 953 online stores infected with a scanner-evading JavaScript loader, nearly all of them Magento. The loader hides inside Magento's cms_block table, the database table that stores static content blocks shown on store pages, so it runs for real shoppers while staying invisible to automated scanners — it checks for automation markers such as navigator.webdriver, Selenium globals and ChromeDriver properties, fingerprints the visitor's GPU, screen size and timezone, and sits behind Cloudflare, responding only to real visitors.
The numbers behind the campaign are stark. In March 2026, attackers injected the loader into 471 stores in about one hour, planting webshells through PolyShell. Of 169 infected Magento 2 installations missing at least one core patch, 102 showed evidence of file uploads through PolyShell or the related SessionReaper flaw (CVE-2025-54236, CVSS 9.1). The newest loader domain turned up in the content blocks of 83 stores, 60 of which had already carried an earlier version of the loader, and 34 had been infected since October 2025 — a sign many merchants were hit before and never fully cleaned up. One store running a current release (Magento 2.4.7-p10, no missing core patches) was compromised through a rogue administrator account instead, and another received the loader an hour after a clean scan. Sansec has not yet obtained the campaign's final payload, so card theft or credential harvesting remain unconfirmed possibilities, not established facts — but the honest conclusion is the same: a clean external scan does not prove a store is safe.
Why it matters for India readers
India has a large Magento and Adobe Commerce footprint — independent brands, D2C stores and the agencies that build and maintain them — and Indian shoppers routinely enter card details on exactly these kinds of stores. A compromised store can skim payment data at checkout without the shopper ever seeing anything wrong, which is why this story matters to both sides of the checkout page. For store owners, the PolyShell timeline is also a warning about patch debt: the flaw was disclosed in March 2026, production fixes arrived in July, and stores that drifted are the ones still getting hit in October. For shoppers, the practical defence is boring but effective: prefer trusted stores, use cards with transaction alerts, and check statements after purchases from unfamiliar shops.
Should you care?
✅ Verdict: If you run a Magento or Adobe Commerce store, treat this as a today job, not a backlog item. The flaw is confirmed exploited, the campaign is still active, and the fix has existed since July. If you only shop on such stores, you cannot patch anything yourself — but knowing the signs (and checking your statements) is the next best thing.
Fixed versions and what to check
Adobe's CVE record lists these versions as affected, with the matching 2026-jul versions as fixed. If your store runs anything at or below the affected levels without the July patch, assume it needs attention.
| Product | Affected (up to and including) | Fixed |
|---|---|---|
| Adobe Commerce | 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | Matching 2026-jul release (e.g. 2.4.9-2026-jul) |
| Adobe Commerce B2B | 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | Matching 2026-jul release |
| Magento Open Source | 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 | Matching 2026-jul release |
| Adobe Commerce Events | 1.20.0 and earlier | 1.21.0 |
Store-owner checklist: apply Adobe's APSB26-73 fixes; search cms_block and cms_page for unexpected scripts and the loader's markers (fpCode, se_referrer); audit administrator accounts and remove any you do not recognise; hunt for webshells disguised as images in upload directories; rotate database, admin and API credentials after cleaning; and review logs for unauthorised changes. Removing the JavaScript alone is not enough — an attacker who got in may still hold database or server access. The same week brought a related warning worth reading: our PHP2Shell flaws added to CISA's exploited list post, and the Gheist GitHub stolen-tokens campaign explained post shows the same "stolen access, quiet persistence" pattern on a different platform.
FAQs
What is the PolyShell vulnerability in Magento? PolyShell (CVE-2026-48356) is a critical file-upload flaw in Adobe Commerce and Magento's REST API. It lets an unauthenticated attacker upload a file disguised as an image that actually contains executable code, which can lead to remote code execution, stored cross-site scripting or account takeover depending on the server's configuration.
What did CISA add to the KEV catalog on 27 October 2026? CISA added CVE-2026-48356 (Adobe Commerce/Magento) and CVE-2026-111497 (Google Brotli) to its Known Exploited Vulnerabilities catalog, confirming active exploitation. US federal agencies must remediate the Adobe flaw by 10 November 2026.
How do I know if my Magento store is infected? Check cms_block and cms_page for unexpected scripts or the loader's markers (fpCode, se_referrer), look for webshells disguised as image files in upload directories, audit admin accounts for unfamiliar entries, and review logs. An external scan coming back clean does not prove safety — this loader deliberately hides from scanners.
Which Magento versions are safe from PolyShell? Stores on Adobe's 2026-jul patch levels (for example 2.4.9-2026-jul) or Adobe Commerce Events 1.21.0, as fixed by bulletin APSB26-73. Anything at or below the affected versions without the July patch should be treated as at risk.
Can shoppers be affected by infected Magento stores? Yes, potentially: the campaign's loader runs in shoppers' browsers on infected store pages, and similar e-commerce malware has historically skimmed payment-card data. Sansec has not yet recovered this campaign's final payload, so card theft is a risk to guard against, not a confirmed outcome here.
TAKEAWAY: PolyShell went from disclosure in March to a CISA exploited-listing in October because unpatched stores kept getting hit — 953 of them and counting. Patch to the 2026-jul releases, clean thoroughly, and never trust a clean scan alone.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (27 October 2026)
- mAlice — CISA adds Adobe Commerce and Magento flaw CVE-2026-48356 to KEV catalog (27 October 2026)
- The Hacker News — Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners (October 2026)
- CybersecurityNews — Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners (October 2026)
- Spartech Software — Magento Malware Campaign Infects 953 Online Stores (October 2026)
- Akamai — Magento PolyShell: The Latest Magento Threat (March 2026)
- SentinelOne Vulnerability Database — CVE-2026-48356: Adobe Commerce RCE Vulnerability
Comments
Post a Comment