PolyShell: CVE-2026-48356 in Adobe Commerce and Magento
PolyShell is a file upload flaw in the Magento and Adobe Commerce REST API, fixed for supported lines in Adobe's July 2026 updates. Sansec says it blocked attempts against 79.5% of the Magento stores it protects.
·
What the flaw is
Sansec, which discovered and named PolyShell, says the REST API lets unauthenticated attackers upload executable files, using code disguised as an image to pass validation. It says the outcome depends on the web server configuration, and can be remote code execution or account takeover through stored cross-site scripting.
Adobe's bulletin APSB26-73 rates the flaw Critical at 9.6 and says it requires no authentication. NVD shows 9.3, and its description says a victim must visit a crafted URL or interact with a compromised page.
What to do
Install the July 2026 update for your branch. Adobe lists 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul for both Adobe Commerce and Magento Open Source, plus 2.4.5-2026-jul and 2.4.4-2026-jul for Adobe Commerce. Adobe Commerce B2B and Adobe Commerce Events have their own updates in the bulletin.
If you cannot update at once, Sansec advises blocking web access to pub/media/custom_options/. It warns that this does not stop uploads, because files still reach the disk and a later configuration change could expose them. Only a web application firewall rule that blocks the API call stops the upload, Sansec says. It also advises scanning for uploaded webshells and backdoors.
Exploitation so far
Sansec published its research on 17 March 2026. It says its product blocked exploitation attempts against 79.5% of the Magento stores it protects, with first probing on 16 March. Ostorlab, summarizing Sansec, gives 19 March as the start of mass scanning. These figures describe Sansec's customers and do not measure all stores worldwide.
CISA added the CVE to its Known Exploited Vulnerabilities catalog on 27 October, with a 10 November deadline for US federal civilian agencies, and lists ransomware use as unknown. Adobe's bulletin, last updated on 11 August, still says Adobe is not aware of exploits in the wild for the issues it covers.
Conflicting fix dates
Sansec says Adobe fixed the flaw in the 2.4.9 pre-release branch and that the 2.4.9 release of 12 May 2026 contains the fix. Ostorlab says Adobe's CVE record instead marks 2.4.9 as affected until the July patch, so check the build you run.
Official records
Further reading
- Sansec ↗: The original research and mitigation steps. Sansec also sells a blocking product.
- Ostorlab ↗: Affected and fixed versions by branch, and the root cause.