CVE-2026-48356: Adobe Commerce and Magento Unrestricted File Upload (CWE-434)

Background

Adobe Commerce and Magento Open Source are widely used e-commerce platforms, so a file upload flaw in them matters to anyone who stores customer data or processes payments through a Magento storefront. CVE-2026-48356 was fixed in Adobe’s July 2026 bulletin, APSB26-73, and CISA added it to the Known Exploited Vulnerabilities catalog on October 27, 2026.

Technical Mechanism

Adobe classifies the flaw as CWE-434, unrestricted upload of a file with a dangerous type, with impact listed as privilege escalation. The NVD description says it “could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session,” that exploitation “requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page,” and that scope is changed.

Adobe published no further technical detail, no researcher credit for this CVE, and no mention of a specific endpoint.

The researcher Sansec ties this CVE to a Magento attack it calls PolyShell. Its main advisory (published March 17, 2026, later updated) says Sansec “discovered and named the PolyShell vulnerability (CVE-2026-48356)”, and its October 24, 2026 write-up refers to “uploading webshells through PolyShell (CVE-2026-48356)” and calls APSB26-73 “Adobe’s PolyShell fix”. Sansec’s March 30, 2026 mass-wave post does not name any CVE. Adobe, NVD and CISA do not mention PolyShell, so the mapping rests on Sansec alone and is not independently confirmed.

Two details do not line up. Sansec says unauthenticated attackers upload executable files through the REST API, while NVD and Adobe’s text describe a vector requiring user interaction (“a victim must visit a maliciously crafted URL”). Sansec also says Magento 2.4.9 (May 12, 2026) already contains the fix, while Adobe’s bulletin lists 2.4.9 as affected and fixed in 2.4.9-2026-jul. This article follows Adobe’s table.

Sansec describes the attack pattern as a PHP webshell dropped via upload, accesson.php backdoors written to several directories, and an obfuscated JavaScript loader injected into CMS pages and blocks.

Real-World Exploitation Evidence

CISA added the CVE to KEV on October 27, 2026, with a due date of November 10, 2026 and ransomware use marked “Unknown.” The KEV entry does not say which reports CISA relied on.

Adobe’s bulletin (published July 14, last updated August 11, 2026) says “Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.” That predates the KEV listing, but it also postdates Sansec’s reports of probing from March 16, mass scanning from March 19 and a mass wave on March 30, so the two accounts are in direct conflict.

Sansec reports a campaign that has hit 953 stores, mostly Magento shops, since July 2025. The Sansec figures below are single-vendor and we could not replicate them. It says that in March 2026 the operator “injected the loader into 471 stores in one hour, after uploading webshells through PolyShell,” and that a newer loader domain first appeared on October 7. Of 169 Magento 2 installs missing at least one core patch, Sansec found 102 (60%) also had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). It also notes the October loader rewrites “used no new vulnerability” and that it has not captured the final payload. We found no evidence of a named threat actor as of 2026-10-28 in Adobe’s bulletin, NVD, the KEV entry or the three Sansec posts.

Impact Assessment

If the Sansec mapping is right, an attacker who gets a webshell onto a storefront can run code as the web user. Sansec warns that deleting the script does not remove that access, because database write access and database-resident loaders can remain. Our inference, not Sansec’s: such a foothold could also be used to tamper with checkout pages. Stores that held customer payment details through the browser are the highest-risk group. If the mapping is wrong, the NVD text instead describes account or session takeover after a victim interaction, which still matters for administrator accounts.

Affected Versions

Adobe’s APSB26-73 lists, for all platforms:

Scores differ. The NVD record (Primary and Adobe CNA entries) is CVSS 3.1 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. Adobe’s bulletin table shows 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. The difference is the availability metric. This article uses NVD’s 9.3.

Remediation Steps

1. Identify every Adobe Commerce, B2B, Magento Open Source and Events installation, including staging copies.
2. Apply the July 2026 -2026-jul release for your line (see the table). Adobe’s bulletin links release notes KA-37421, which we did not open.
3. Do not stop at patching. Sansec’s guidance is to check for compromise, because a patch does not remove an existing foothold.
4. Search cms_block and cms_page for loader code and check update_time.
5. Review admin_user for unknown accounts, then rotate database, admin and API integration credentials after cleanup.
6. Apply APSB25-88 (SessionReaper) if it is missing, as Sansec found stores compromised through both.

Detection Guidance

All indicators below come from Sansec’s October 24 and March 30, 2026 write-ups; we did not test them. Domains are defanged.

• Paths: pub/media/custom_options/quote/ (Sansec says PNG-disguised webshells), pub/media/custom_options/, pub/media/customer_address/.
• Filename: accesson.php. Sansec also lists the backdoor beacon value 8194460.
• Strings: fpCode, se_referrer, QWE=123;, and localStorage keys 136c1e07507f4a97 and 136c1e07507f4a98.
• Domains: deepveindrilling[.]com, additionalver[.]com, lanhd6549tdhse[.]top, neswnsssn[.]click, manulfie[.]click, hdfdsi84j3h[.]top, c85grt98sd[.]com, leqdger[.]click, crypto-insider[.]top.
• Database: cms_block.content, cms_page, admin_user.

Sansec notes the loader serves content by browser fingerprint, so scanners and automated Chrome sessions can see nothing unusual. Check the database and filesystem directly. The two Sansec loader posts publish no file hashes or IP addresses. Sansec’s separate PolyShell advisory lists 50+ scanning IP addresses, which we have not reproduced here; take them from that advisory.

Timeline

References

• Adobe APSB26-73
• NVD: CVE-2026-48356
• Sansec: CMS block loader, October 24, 2026
• Sansec: PolyShell advisory
• Sansec: PolyShell mass attack wave, March 30, 2026
• CISA KEV catalog entry