CVE-2026-48356: Magento PolyShell File Upload Hits CISA KEV - Floor 2.4.x-2026-jul

CVE-2026-48356 is an unrestricted file upload (CWE-434) in Adobe Commerce and Magento Open Source. Adobe scored the July bulletin row 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L). NVD’s current 3.1 (Adobe CNA and NVD Primary) is 9.3 (…/A:N). Authentication required, per Adobe: No. Patch date: 14 July 2026, bulletin APSB26-73, priority 2. Floor Adobe named: the 2.4.x-2026-jul (and matching B2B / Events) builds. CISA added the ID to KEV on 27 October 2026. Federal due date 10 November 2026. Ransomware-campaign flag: Unknown.[1][2][3][4]

Sansec named the same ID PolyShell and is the CISA-ADP extra reference on the NVD object. Their write-up is not Adobe’s advisory. We quote them as a researcher source, not as a patch.[5][2]

If you run Magento 2 or Adobe Commerce on a public origin, this is the KEV, the version floor, and what to look at after you patch.

What it is

Adobe’s words: the store accepts a file of a dangerous type, which can mean arbitrary code execution in the context of the current user and elevated access or control over the victim’s account or session. NVD repeats that a victim must visit a crafted URL or interact with a compromised page (UI:R). Scope is changed (S:C).[2][1]

Adobe’s impact column on this row is privilege escalation, not “RCE.” NVD’s description is ACE in the current-user context. Sansec’s PolyShell post is more specific: Magento’s REST guest-cart item path can write a file under pub/media/custom_options/ without checking that the product actually has a file option, and without blocking .php / .phtml / .phar. GraphQL, they say, is a different code path and not this bug. We did not re-test that API. Treat the endpoint names as Sansec’s analysis, not Adobe’s.[1][2][5]

This is not PHP2Shell (CVE-2026-109618 / 109619). Those are engine bugs in PHP. This ID is the store application. Patch Magento and PHP if you are behind on both.

APSB26-73 also ships other CVEs (webhooks RCE, stored XSS, authz bypasses). Only 48356 is on KEV today. Do not collapse the bulletin into this one ID - apply the whole July package, then whatever Adobe shipped after it.[1][3]

How serious

CISA listing a Magento upload bug on KEV means they have evidence of active exploitation. That is a stronger claim than a CVSS number. CISA’s SSVC row on NVD (timestamp 2026-10-27T19:53:15Z, role CISA Coordinator): exploitation: active, automatable: no, technicalImpact: total.[2][3][4]

Adobe’s July bulletin - last updated 11 August 2026 on the page we fetched - still says Adobe was not aware of exploits in the wild for the issues in APSB26-73. Those two statements can both be true at different times. Sansec dates probing from 16 March 2026 and a mass wave on 30 March 2026. CISA’s public add is 27 October. We did not receive victim names, sample counts, or a CISA forensic packet.[1][3][5]

A checkout-path app that will execute an uploaded PHP file is a store compromise: admin session, orders, customer PII, payment-integration keys. It is not a claimed KVM/QEMU guest-to-host, panel root, or kernel bug.

Who is affected

Adobe’s affected table (APSB26-73):[1]

Adobe Commerce: 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier; 2.4.5-p17 and earlier; 2.4.4-p18 and earlier.
Magento Open Source: 2.4.9; 2.4.8-p5 and earlier; 2.4.7-p10 and earlier; 2.4.6-p15 and earlier.
Adobe Commerce B2B: 1.5.3; 1.5.2-p5 and earlier; 1.4.2-p10 and earlier; 1.3.4-p17 and earlier; 1.3.3-p18 and earlier.
Adobe Commerce Events: 1.6.0 to 1.20.0.

Fixed builds Adobe named:[1]

Commerce: 2.4.9-2026-jul through 2.4.4-2026-jul
Magento Open Source: 2.4.9-2026-jul through 2.4.6-2026-jul
B2B: 1.5.3-2026-jul through 1.3.3-2026-jul
Events: 1.21.0

Adobe still lists 2.4.9 itself as affected; the named clean build is 2.4.9-2026-jul. Sansec’s 12 May note that “2.4.9 contains the fix” is their timeline, not a substitute for Adobe’s table. If composer.lock does not show a 2026-jul (or later security) package, do not assume you are out.[1][5]

Out of scope for this CVE ID unless you have another advisory:

WordPress / WooCommerce (different apps).
Magento 1.x - not in APSB26-73. Treat as unsupported, not “safe.”
PHP2Shell. Different CVEs, already on KEV.

A later Adobe bulletin (we fetched APSB26-153, 13 October 2026) is a different package. Being on a 2026-sep / 2026-oct line should be past this July floor; it does not mean you can skip current Adobe security updates.

What to do now

The patch is the Magento/Adobe package. Inventory the running Composer product, not a marketing screenshot.

Read the installed product and version.

php bin/magento --version
composer show magento/product-community-edition 2>/dev/null
composer show magento/product-enterprise-edition 2>/dev/null
# lockfile is the source of truth on a built box
python3 -c "
import json
lock=json.load(open('composer.lock'))
want=('magento/product-community-edition','magento/product-enterprise-edition','magento/magento2-base')
for p in lock.get('packages',[]):
    if p.get('name') in want:
        print(p['name'], p.get('version'))
"

Apply APSB26-73 for your line, then current Adobe security. Matching 2.4.x-2026-jul (or the B2B/Events row) is the floor Adobe published for 48356. If you already skipped July and jumped to a later official security package, confirm that package’s notes include APSB26-73 / 48356. Deploy through staging; Magento upgrades are not wp plugin update. Restart php-fpm / LiteSpeed after the new code is live so old workers die.[1]
If you cannot patch today. Take the store off the public internet or put admin and /rest/ behind an allowlist. A WAF is a stopgap for requests it can recognise. Sansec’s nginx deny on pub/media/custom_options/ is a containment for execution of files already on disk; Adobe’s fix is still the application patch. We are not recommending a third-party product.[5]
Unsupported lines. Magento 1, 2.3, and anything Adobe did not ship a 2026-jul build for: upgrade or isolate. Do not wait for a backport that is not in the bulletin.[1]
Hunt after you patch. Patching does not remove a webshell that landed in March-October. Keep logs. We are not publishing an exploit.

Versions with no Adobe 2026-jul build

If your composer.lock product is not one of the rows in APSB26-73’s solution table, there is no named floor in that bulletin. Upgrade to a supported 2.4 line and apply current security, or keep the origin off the internet.

Adobe Commerce 2.4.4 / 2.4.5 still received 2026-jul in this bulletin. Magento Open Source’s table in the same PDF/HTML starts at 2.4.6. Do not copy the Commerce row onto Open Source or the other way around.[1]

How to spot a compromise

Sansec’s IoCs (CISA-ADP also pointed NVD at these posts). Treat as hunt targets, not proof, and not unique to 2026-10-27:[5][6]

# any PHP/phtml/phar under the custom-options upload tree is not a product image
find pub/media/custom_options/ -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \)

# secondary drop name they documented
find /var/www -name 'accesson.php' -type f

Also look for:

New or changed PHP under pub/media/ dated in windows you cannot match to a deploy.
CMS pages / static blocks with unexpected remote <script src> hosts.
php-fpm / nginx workers spawning shells or outbound curl/wget as the web user.
Admin users you did not create; unexpected cron in cron_schedule / crontab.

If you find a shell: isolate, snapshot, keep var/log/ and web logs before cleanup. PCI stores: involve the card brand / acquirer process your contract names. We are not publishing payloads.

FAQ

Is there a patch? Yes. Adobe 14 July 2026, APSB26-73. Floor: the *-2026-jul builds in that bulletin.[1]

Is it on CISA KEV? Yes. Added 2026-10-27. Due 2026-11-10 for FCEB under BOD 26-04. Ransomware use Unknown.[3][4]

Do I need a Magento admin login? Adobe: authentication required? No. CVSS still has UI:R. Sansec describes unauthenticated REST guest-cart uploads. Those are different phrasings. Do not drop UI:R because a blog post omitted it.[1][2][5]

Does this give root on the hypervisor? No. Claimed impact is the PHP user on the store, plus Magento session/account control.

Is 2.4.9 enough? Adobe lists 2.4.9 as affected and 2.4.9-2026-jul as the update. Confirm the lockfile string.[1]

We applied October’s Adobe security bulletin. Then you should be past this July floor. Still apply whatever Adobe lists as current, and still hunt custom_options - KEV means the window was long.[1]

Is this PHP2Shell? No.

Honesty

We did not exploit this. No REST guest-carts POST was sent. No polyglot was uploaded.
Adobe’s July/August bulletin text still says no known in-the-wild. CISA KEV on 27 Oct says they have exploitation evidence. Sansec’s campaign dates start in March. We cannot reconcile victim counts from here.
Adobe CVSS on the bulletin HTML is 9.6 / A:L. NVD now shows 9.3 / A:N for both CNA and Primary. We report both.
Adobe impact = privilege escalation. NVD description = ACE in current-user context. Sansec = unauth RCE via polyglot. Those are their labels.
We did not inventory our fleet for Magento versions in this run.
Sansec Shield / eComscan are vendor products. This post does not require them. The find commands above are the open hunt.
Social-preview caches are platform-side and cannot be purged from here.

Sources

[1] https://helpx.adobe.com/security/products/magento/apsb26-73.html - APSB26-73, published 14 Jul 2026 (page last updated 11 Aug 2026)
[2] https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-48356 - NVD object, lastModified 2026-10-27T20:17:14.683Z
[3] https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog - CISA alert, 27 Oct 2026
[4] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - KEV JSON, dateReleased 2026-10-27T19:00:02.2307Z, count 1760, CVE-2026-48356 dateAdded 2026-10-27
[5] https://sansec.io/research/magento-polyshell - Sansec PolyShell analysis (CISA-ADP NVD reference)
[6] https://sansec.io/research/polyshell-mass-attack-wave - Sansec 30 Mar 2026 wave (CISA-ADP NVD reference)
[7] https://www.cve.org/CVERecord?id=CVE-2026-48356 - CVE record linked from the CISA alert