CVE-2026-48356 (CVSS 9.3): Magento ‘PolyShell’ Zero-Day Hits CISA KEV — 471 Stores Backdoored in One Hour

On October 27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 — a critical, unauthenticated file-upload flaw in Adobe Commerce and Magento Open Source — to its Known Exploited Vulnerabilities (KEV) catalog. Dubbed “PolyShell” by e-commerce security firm Sansec, this vulnerability allows an unauthenticated attacker to upload a PHP webshell through the publicly accessible guest-cart REST API — no login, no administrator credentials, no prior foothold required. Sansec’s honeypot data recorded 471 stores backdoored in a single hour during an attack wave in March 2026. Seven months later, CISA has now confirmed active exploitation in the wild and ordered all U.S. federal civilian agencies to patch by November 10, 2026. If your business runs an Adobe Commerce or Magento storefront, that deadline applies to you in spirit — and the clock is ticking.

What Is PolyShell and Why Is It So Dangerous?

Magento’s guest-cart REST API (POST /rest/default/V1/guest-carts/{cartId}/items) accepts product customization options — including file uploads for personalised products such as engraved jewellery or printed merchandise. The vulnerability (catalogued under NVD CVE-2026-48356) lies in how the server validates those uploads: it checks only for image magic bytes in the file header, not whether the file contains executable code.

An attacker crafts a file that starts with the GIF magic bytes GIF89a — fooling the header check — but whose body is a PHP webshell. Once the upload succeeds, the file lands in the store’s publicly accessible directory:

pub/media/custom_options/quote/<store_id>/<filename>.php

Depending on the web-server configuration, the attacker can then request that path directly and execute arbitrary PHP code — achieving full remote code execution (RCE) in the context of the web-server user. Adobe’s reference nginx and Apache configs block execution in that directory, but a significant proportion of self-hosted and managed-hosting deployments do not match Adobe’s hardened defaults.

The term PolyShell refers to the polyglot file technique: the malicious payload is simultaneously a valid image (passes the header check) and a valid PHP script (executes when the server processes it). This approach elegantly bypasses the only gating control Magento had in place.

Technical Breakdown: The Kill Chain

Stage	Action	Detail
1. Reconnaissance	Find Magento stores	Shodan, BuiltWith, or automated Magento fingerprinting (common header: X-Magento-Vary)
2. Cart Creation	POST /rest/…/guest-carts	Returns a cart UUID — no account needed
3. Upload	POST /rest/…/items with file option	GIF89a-prefixed PHP webshell passes header validation
4. Execution	GET /pub/media/…/<shell>.php	Web server executes shell if directory is PHP-enabled (default on many hosts)
5. Persist & Pivot	Credential harvest, skimmer injection	Database passwords, admin creds, payment card skimmers embedded in checkout JS

Sansec researchers observed attackers using the webshell to inject JavaScript-based payment card skimmers into checkout pages — a classic Magecart-style attack where customer card numbers are silently exfiltrated at the point of payment. This is precisely why CISA treats PolyShell as actively exploited, even as Adobe’s own bulletin still states it is “unaware of exploitation” in the wild.

The Scale: India’s Magento Exposure

Adobe Commerce and Magento power a significant share of India’s e-commerce landscape. According to BuiltWith statistics, Magento remains one of the top three e-commerce platforms in use across Indian SMBs, regional D2C brands, and B2B distributors — many running self-hosted, managed-VPS, or cloud-hosted deployments managed by local IT teams or web agencies. Critically, many of these deployments lag several patch cycles behind, particularly on the 2.4.6 and 2.4.7 long-term-support branches, which remain widely deployed.

For any business processing payments through a Magento storefront — whether in Delhi NCR, Mumbai, Bengaluru, or beyond — the risk profile from PolyShell is direct: unauthenticated, remote, zero-interaction access to the server, followed by payment-card exfiltration affecting your customers and triggering your PCI-DSS obligations.

This is not a theoretical risk. The Sansec research documented 471 stores compromised within 60 minutes during the March 2026 attack wave — an automated, industrial-scale exploitation that distinguishes PolyShell from slower-moving vulnerabilities. Separately, Sansec later reported that a related campaign infected 953 stores with scanner-evading JavaScript using compromised Magento infrastructure.

Affected Versions and the Fix

Adobe’s security bulletin APSB26-73 (issued July 14, 2026) addresses CVE-2026-48356. The vulnerability affects all supported release lines prior to the July 2026 security releases:

• Adobe Commerce and Magento Open Source 2.4.9 → patched in the May 2026 general release
• 2.4.8-p5 (and all earlier 2.4.8-pX builds) → patch: 2.4.8-2026-jul
• 2.4.7-p10 (and all earlier 2.4.7-pX builds) → patch: 2.4.7-2026-jul
• 2.4.6-p15 (and earlier 2.4.6-pX builds) → patch: 2.4.6-2026-jul
• 2.4.5-p17 and 2.4.4-p18 and earlier
• Adobe Commerce B2B is also affected — consult the bulletin for B2B-specific patch builds

Installations on end-of-life versions (2.4.3 and below) will not receive a patch and should be treated as compromised-until-proven-otherwise if they are publicly accessible.

What You Should Do Right Now

Here is the prioritised response checklist Sanjay recommends for any organisation running Adobe Commerce or Magento:

1. Patch immediately. Apply APSB26-73 for your release line. For production stores that cannot patch within 24 hours, proceed to step 2 as an emergency interim.
2. WAF rule — block the vulnerable endpoint. Add a WAF rule to block or require authentication for requests to /rest/*/V1/guest-carts/*/items with multipart file upload content types, unless your store genuinely requires guest file-upload functionality.
3. Disable PHP execution in upload directories. Ensure your nginx or Apache config prevents PHP execution inside pub/media/. Adobe’s sample configs include this by default; verify your host has not stripped it.
4. Scan for existing webshells. Search for recently created PHP files in pub/media/custom_options/ and across the document root. Any .php file in a media directory is suspicious. Tools: Sansec’s free eComscan, or a file-integrity monitoring baseline.
5. Rotate credentials. If you find evidence of compromise — or simply cannot rule it out — rotate the database password, Magento admin passwords, payment gateway API keys, and any cloud-storage credentials accessible from the web-server user.
6. Check checkout JavaScript for skimmers. Review your theme’s checkout JS for unexpected external script loads, base64-encoded blobs, or requests to unknown domains. Attackers who gained shell access routinely inject Magecart-style card skimmers.
7. Review your hosting provider’s patch posture. If you use a managed Adobe Commerce or Magento hosting service, confirm in writing that they have applied APSB26-73. Managed hosting does not automatically mean patched.

Zero-trust principles extend to e-commerce stacks: treat every internet-facing endpoint — including seemingly innocuous guest-cart APIs — as a potential ingress point. For organisations running layered defences using next-generation firewalls with application-layer inspection, these endpoint-specific controls can often be enforced at the perimeter even before the application layer is patched. See how these controls fit into a broader zero-trust architecture using modern NGFW platforms.

Similarly, the PolyShell technique — polyglot file upload leading to server-side code execution — mirrors the webshell delivery mechanism Sanjay covered recently in CVE-2026-110447 on Nextcloud Collabora. The attack pattern is consistent: find an unauthenticated upload endpoint, bypass weak content-type validation, gain execution. Defending against it requires defence-in-depth at multiple layers, not a single control.

The CISA KEV Signal: Why This Matters for Non-Federal Organisations

CISA’s Known Exploited Vulnerabilities catalog was created for U.S. federal civilian agencies under Binding Operational Directive 22-01 — but its strategic value extends far beyond Washington. When CISA confirms active exploitation, it is drawing on threat intelligence from across the U.S. government and its private-sector partners. A KEV listing is a high-confidence signal that:

• The vulnerability has a working, weaponised exploit available to threat actors
• Exploitation is happening now, at scale, against real targets
• The window between awareness and broad exploitation has closed

For Indian enterprises and SMBs, there is no equivalent regulatory mandate — but the risk is identical. Threat actors do not limit their scanning to U.S. IP space. Shodan and Censys see your Magento store. Automated exploit kits do not require a work visa.

Frequently Asked Questions

Do I need to worry if my Magento store doesn’t sell customisable products?

Yes. The vulnerable guest-cart file-upload endpoint exists regardless of whether you have enabled product customisation options in your catalogue. The API route is present in the default Magento installation. Attackers do not limit themselves to stores that appear to use the feature — they probe all reachable Magento instances. The safest approach is to disable or WAF-protect the endpoint until you can patch.

My hosting provider says they manage Magento security updates. Am I covered?

Verify, don’t assume. Ask your provider to confirm in writing that they have applied APSB26-73 and provide the specific version or patch build running in your environment. Managed hosting tiers vary widely in their patch cadence. Some providers patch critical CVEs within 24 hours; others patch on a monthly cycle. Given that CISA has confirmed active exploitation, “monthly cycle” is not fast enough for this vulnerability.

CISA’s deadline is November 10 and that’s for U.S. federal agencies. Why should I care?

The CISA deadline is a regulatory floor for U.S. government systems, not a ceiling for private-sector diligence. The exploitation that triggered the KEV listing was happening months ago — in March 2026. The November 10 deadline means federal agencies have a maximum of two more weeks to patch. Any organisation that waits until November 10 is accepting that it may be compromised in the interval. The appropriate deadline for commercial organisations is: now.

How do I know if my store was already compromised?

Run a file-integrity scan across pub/media/ for any PHP files — none should be there in a healthy store. Check your web-server access logs for requests to /pub/media/custom_options/ paths ending in .php. Review your checkout pages for unexpected script tags. If you find suspicious files, don’t delete them before taking forensic copies — you will need them for incident response, insurance claims, and regulatory notifications under India’s CERT-In reporting requirements. Contact a qualified incident-response partner immediately.

---

Sanjay Seth has spent three decades securing enterprise networks across India — from zero-trust architecture deployments to active incident response. If your organisation runs Adobe Commerce, Magento, or any other internet-facing application platform and you are concerned about your current security posture, reach out for a professional security assessment. An expert eye on your perimeter defences, patch posture, and application-layer controls can mean the difference between a close call and a confirmed breach.