Adobe Commerce "PolyShell" file upload exploited to plant webshells on stores

CVE-2026-48356 is a CWE-434 unrestricted file upload flaw in Adobe Commerce and Magento Open Source. Adobe rates it Critical and says it needs no authentication and no admin privileges ¹. Sansec found and named the bug "PolyShell". Sansec says it lets unauthenticated attackers upload executable files through Magento's REST API by disguising code as an image ⁴. Adobe fixed it for supported release lines in APSB26-73 on 2026-07-14 ¹.

Sansec says attacks began on 2026-03-19, two days after its public disclosure and before any production patch existed ⁴. Sansec reports that malicious PHP had been uploaded to 56.7% of stores by 2026-03-24, and that malicious uploads had hit 82% by 2026-04-14 ⁴. These figures come from Sansec's own telemetry. On 2026-03-30, a fully automated chain compromised 471 stores in one hour ⁵. Each compromise followed the same steps: upload a webshell, plant accesson.php backdoors, then inject a JavaScript loader into CMS content ⁵.

Sansec links PolyShell to a long-running loader campaign that has hit 953 stores since July 2025 ⁶. PolyShell is one of the access routes, but Sansec has not shown how the earliest infections began ⁶. The loader filters out scanners. No final payload has been recovered, so the campaign's goal is unconfirmed ⁶. CISA added the CVE to KEV on 2026-10-27, with ransomware use listed as unknown ². Adobe's bulletin, in its 2026-08-11 revision, said Adobe was not aware of exploits in the wild ¹.

Sansec says the vulnerable upload path never checks the submitted option against the product's real custom options and never restricts file extensions ⁴. The only check is an image-header test. A polyglot file, valid as an image but also containing code, passes that test ⁴. Sansec says the code has existed since the first Magento 2 release. GraphQL mutations use a different code path and are not affected ⁴.

The most dangerous entry points are anonymous guest-cart REST API routes, though Sansec says they are not the only vulnerable ones. Uploaded files land under pub/media/custom_options/ ⁴. The impact depends on the web server. Code execution needs a server that runs PHP from the upload directory, such as a non-stock nginx config that sends every .php file to fastcgi ⁴. Other configurations allow stored XSS or account takeover ⁴. Where execution is blocked, the file still stays on disk and becomes dangerous if the config changes later ⁴.

Adobe's vector requires user interaction and marks the scope as changed ¹. CISA's description refers to code execution in the context of the current user, with possible control of the victim's account or session ³. That wording is closer to a client-side impact than to the server-side webshells Sansec observed. Defenders should treat both outcomes as possible.

1. 1

   Install APSB26-73 for your release line (the -2026-jul builds), published 2026-07-14 ¹. CISA requires federal agencies to apply vendor mitigations by 2026-11-10, or stop using the product if no mitigation is available ².

2. 2

   Until you can patch, use a WAF rule that blocks the vulnerable REST API upload call. Sansec, which sells such a WAF, says only that stops the attack ⁴. Web-server rules that deny access to pub/media/custom_options/ limit the damage but do not stop uploads ⁴.

3. 3

   Make sure the web server never executes PHP from media and upload directories. Code execution depends on a config that runs PHP there, such as nginx passing every .php file to fastcgi ⁴.

4. 4

   Assume breach on any store exposed before patching. Run the hunts above, remove webshells, backdoors and injected CMS content, and delete rogue admin accounts. Sansec saw a 2.4.7-p10 store with no missing core patches get the loader after a rogue admin account and a GSocket backdoor had been found on it ⁶.

5. 5

   After cleanup, rotate the database, admin and API integration credentials ⁶. Also install APSB25-88 for SessionReaper (CVE-2025-54236): on 60% of loader-infected installs missing a core patch, Sansec found files uploaded through PolyShell or SessionReaper ⁶.

• List every file in pub/media/custom_options/ and pub/media/customer_address/ other than .htaccess ^4,6. Any .php, .phtml or .phar file there is a strong sign of compromise ⁴. On one store, Sansec found PolyShell webshells disguised as PNG images in pub/media/custom_options/quote/ ⁶.
• Search the whole document root for files named accesson.php. Sansec found copies in assets/images/ subdirectories under many top-level folders, including app, lib, pub, vendor, var, bin, setup and generated ⁴.
• The accesson.php backdoor returns the fixed string 8194460 on any request, which attackers use to find live shells ⁴. Look for that string in responses from crawls of your own sites. Also check web logs for requests to accesson.php.
• Review web server logs for anonymous upload requests to guest-cart REST API routes, the most dangerous entry points Sansec identifies ⁴. Sansec says other routes are also vulnerable, so do not rely on guest-cart logs alone ⁴.
• Query cms_block and cms_page (check for a table prefix) for content containing fpCode, se_referrer or localStorage.getItem. The update_time column shows the attacker's latest write ⁶. Loader domains may be base64-encoded, so search for these code patterns as well as domain names ⁶.
• Check admin_user for unrecognized accounts and look for unfamiliar processes. Sansec found a rogue admin account and a GSocket backdoor on one compromised store ⁶.
• If a store loads any listed loader domain, assume the attacker can still write to the database. Removing the injected script does not remove that access ⁶.

1. Mar 16, 2026

   Sansec sees the first PolyShell probing and adds protection to its WAF. ⁴

2. Mar 17, 2026

   Sansec publicly discloses PolyShell. No official patch exists for production versions. ⁴

3. Mar 19, 2026

   Sansec observes the first in-the-wild attacks. Its timeline dates mass scanning from 2026-03-23. ⁴

4. Mar 30, 2026

   An automated mass wave injects the lanhd6549tdhse.top loader into 471 stores in one hour. ⁵

5. May 12, 2026

   Adobe releases Magento 2.4.9. Sansec says it contains the fix, but Adobe's bulletin lists 2.4.9 as affected. ⁴

6. Jul 14, 2026

   Adobe publishes APSB26-73 with fixes for supported release lines, and the CVE is published. ¹

7. Oct 7, 2026

   First stores load the newest loader domain, deepveindrilling.com. ⁶

8. Oct 24, 2026

   Sansec publishes research tying the 953-store loader campaign partly to PolyShell (CVE-2026-48356). ⁶

9. Oct 27, 2026

   CISA adds CVE-2026-48356 to KEV with a federal due date of 2026-11-10. ²

1. 1
   Security update available for Adobe Commerce | APSB26-73

   Adobe · Vendor · Jul 14, 2026
2. 2
   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   CISA · Government · Oct 27, 2026
3. 3
   Known Exploited Vulnerabilities Catalog entry: CVE-2026-48356

   CISA · Government · Oct 27, 2026
4. 4
   PolyShell: unrestricted file upload in Magento and Adobe Commerce

   Sansec · Research · Mar 17, 2026
5. 5
   Mass PolyShell attack wave hits 471 stores in one hour

   Sansec · Research · Mar 30, 2026
6. 6
   deepveindrilling.com: Magento CMS block loader hits 953 stores

   Sansec · Research · Oct 24, 2026