Magento / Adobe Commerce PolyShell: unauthenticated file upload (CVE-2026-48356) exploited in the wild
Published 29/10/2026 10:19
Timeline
3 events over 13 d
- 16/10/2026 08:32ConfirmedNCSC-NL advisories+10 d
- 27/10/2026ExploitedCISA Known Exploited Vulnerabilities+2 d 9 h
- 29/10/2026 10:19Published on WatchtowerPro CISO
In short
PolyShell (CVE-2026-48356) is an unrestricted file upload flaw in Adobe Commerce and Magento Open Source. Unauthenticated attackers can upload executable files through the REST API by disguising code as an image. Adobe released fixes on 14/07/2026 under APSB26-73. VulnCheck listed the flaw as known exploited on 24/10/2026, citing Sansec's report of exploitation. GreyNoise reports a public exploit for CVE-2026-48356; listed by CISA as known exploited (29/10/2026).
How bad is it
Critical. An attacker who can reach a vulnerable store over the internet can upload and run their own code on the server, without logging in.
Being exploited.
Severity score
CVSS from the vendor, via our research, read 29/10/2026.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Adobe Commerce: 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier (APSB26-73).
- Magento Open Source: 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier (APSB26-73).
- Adobe Commerce B2B: 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier (APSB26-73).
- Adobe Commerce Events: 1.6.0 to 1.20.0 (APSB26-73).
What to do now
- Install APSB26-73 for your branch: Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul or 2.4.4-2026-jul; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul or 2.4.6-2026-jul; B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul or 1.3.3-2026-jul; Events 1.21.0.
- Interim measures reduce exposure and do not make a store safe. Ask your host to add a WAF rule that blocks the guest-cart items REST API call, and to deny PHP execution and direct access in pub/media/custom_options/.
- Check for compromise, since exploitation has been going on since March 2026: run find pub/media/custom_options -type f -not -name '.htaccess' and treat any file found as suspect; look for accesson.php outside the usual upload directory.
- Search CMS blocks and static content for the domains lanhd6549tdhse[.]top, jslibrary[.]net, canevaslab[.]com, additionalver[.]com and deepveindrilling[.]com, and check admin_user for unknown accounts.
- If compromise is found, rotate database, admin and API integration passwords.
- On branches with no fix, upgrade to a supported release; until then use only the WAF rule and the execution block.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 3 open questions, followed up as sources answer and all 8 sources with their dates. And technology matching: which of your systems run Magento, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Adobe Commerce and Magento - Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability Vendor · NCSC-2026-0436 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Commerce CERT · [UPDATE] [kritisch] Adobe Magento: Mehrere Schwachstellen CERT