critical exploited in the wild CVSS 9.3 EPSS 44.6%

PolyShell

CVE-2026-48356 APSB26-73 Adobe Commerce / Magento 2.x CISA KEV 2026-10-27

If it is missing Adobe's APSB26-73 update of 14 July 2026, the guest-cart REST routes accept a file upload through a product's custom options with no login, checked only by an image-header test that a polyglot file passes, and write it under pub/media/custom_options/quote/. Whether the file then runs as PHP depends on the web server configuration. Adobe scores it 9.3 and lists Adobe Commerce 2.4.4 to 2.4.9, Magento Open Source 2.4.6 to 2.4.9 and B2B 1.3.3 to 1.5.3 as affected. Sansec reported mass exploitation from March 2026, before the fix reached 2.4.8 and older, and CISA added it to the Known Exploited Vulnerabilities catalogue on 27 October. Verify the exact patch level, and look for planted files even if the patch is in place.

Is my store affected?

A free passive scan tells you whether your store is on an affected line, along with everything else we can see from outside. It takes under a minute and needs no account.

How we detect this

We infer the platform and version line from signals the storefront serves publicly: the version endpoint when it is reachable, markup and cookie markers when it is not, and the fingerprints of static assets that changed between releases. If that line is one CVE-2026-48356 affects, we say so.

We do not attempt to exploit it, and we never claim a store is vulnerable from a version string alone. A patched store and an unpatched one on the same release look identical from outside, so the finding is marked inferred and phrased as something to verify. It does not affect your grade.

How to fix it

Apply Adobe's July 2026 isolated patch for your line, block the custom-options upload directory at the web server, then look for files and content an attacker may already have left.

1
Find your exact version. The July isolated patch only fits the latest security release of each line (2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18). On anything older, move to that release first.
```
bin/magento --version
```
2
Download the July isolated patch for your version from Adobe's knowledge-base article ka-37421 (for example 2-4-8-p5-jul-2026.zip) and unzip it in the Magento root. Apply the core file always, the Commerce file on Adobe Commerce and the B2B file only if B2B is installed. Adobe's monthly isolated patches build on each other, so July goes on before September's and October's. On Adobe Commerce Cloud the fix ships in the latest cloud-patches release instead: do not add the isolated patch on top. The dry run must pass before the real one.
```
patch -p1 --dry-run < <patch-file> && patch -p1 < <patch-file>
```
3
Rebuild so the patched code is compiled and served; skip static-content:deploy in developer mode. The July patch also installs Adobe's Commerce Version Tool, which reports what is applied.
```
bin/magento setup:upgrade && bin/magento setup:di:compile && bin/magento setup:static-content:deploy -f && bin/magento cache:flush && php vendor/bin/patch-status
```
4
Stop anything in the upload directory from being served, whatever the patch level. On nginx, put this before any location that passes .php to PHP-FPM. On Apache, pub/media/custom_options/.htaccess must hold php_flag engine 0 and Deny from all.
```
location ~* ^/(pub/)?media/custom_options/ { return 403; }
```
5
Look for planted files. Anything other than .htaccess under custom_options is suspect, and any .php, .phtml or .phar there is a web shell. Sansec found a second backdoor, accesson.php, dropped in new assets/images/ folders across the codebase.
```
find pub/media/custom_options/ -type f ! -name '.htaccess' && find . -name accesson.php -type f
```

The campaign also injects a script loader into CMS blocks and pages. Search them for the domains Sansec published; a match points to the campaign, so treat the store as compromised and clean it before trusting the patch.

SELECT 'block', block_id, identifier FROM cms_block WHERE content REGEXP 'deepveindrilling|additionalver|lanhd6549tdhse|manulfie|neswnsssn|jslibrary|canevaslab' UNION ALL SELECT 'page', page_id, identifier FROM cms_page WHERE content REGEXP 'deepveindrilling|additionalver|lanhd6549tdhse|manulfie|neswnsssn|jslibrary|canevaslab';

Check it worked

bin/magento --version && php vendor/bin/patch-status && find pub/media/custom_options/ -type f ! -name '.htaccess'

References

From intelligence vault 2026.10.3, released 2026-10-31. What changed