critical severityConfidence highHistorical record

Magento PolyShell lets anyone upload a webshell through the guest cart REST API, now on CISA KEV (CVE-2026-48356)

Direct answer

Magento PolyShell lets anyone upload a webshell through the guest cart REST API, now on CISA KEV (CVE-2026-48356), also tracked as CVE-2026-48356 / PolyShell / Magento PolyShell is a critical-severity threat campaign HOL Guard tracked from Mar 17, 2026 to Oct 27, 2026, verified against 8 primary sources and last reviewed Oct 27, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-48356, named PolyShell by Sansec, is an unrestricted file upload (CWE-434) in Adobe Commerce and Magento Open Source. The REST guest cart endpoints POST /rest/V1/guest-carts/:cartId/items and PUT /rest/V1/guest-carts/:cartId/items/:itemId accept a file_info object (base64 data, MIME type, filename) inside cart item custom options and write it to pub/media/custom_options/quote/. Sansec found that Magento did not check that the option ID belongs to the product, did not require a file-type option, and did not restrict the extension; the only gate was an image header check, so a GIF89a-prefixed PHP file passes. Whether the upload becomes remote code execution or stored XSS depends on whether the web server serves or executes files in that folder. Adobe fixed it in Magento 2.4.9 (May 2026) and backported the fix to supported lines in APSB26-73 on 2026-07-14 (CVSS 9.3). Sansec documented exploitation from March 2026, including 471 stores compromised in one hour on 2026-03-30 and a skimmer-loader crew that has used PolyShell uploads on Magento stores through October 2026. CISA added CVE-2026-48356 to the KEV catalog on 2026-10-27 with a 2026-11-10 due date.

Also tracked as CVE-2026-48356 · PolyShell · Magento PolyShell · Adobe Commerce PolyShell · APSB26-73 · Magento guest cart file upload · CVE-2026-48356 CISA KEV

First observed
Mar 17, 2026
Last observed
Oct 27, 2026
Last reviewed
Oct 27, 2026
Tracking ended
Oct 27, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

CISA does not publish the evidence behind KEV entries. Adobe's APSB26-73 bulletin still states Adobe is not aware of exploits; exploitation evidence comes from Sansec's research. Remote code execution depends on web server configuration; on Adobe's sample nginx and Apache configs the uploaded file is not served. Store counts are Sansec's observations, not a census.

  • Stores on the APSB26-73 -2026-jul releases are not open to new PolyShell uploads but may still hold files uploaded before patching
  • Magento GraphQL cart mutations use a different code path and are not the vulnerable entry point per R-fx Networks
  • Servers that deny pub/media/custom_options/ and disable PHP there limit impact but still receive uploaded files
  • The KEV due date of 2026-11-10 binds US federal civilian agencies only
  • Deleting injected CMS scripts does not remove database or admin access the attacker already has

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not sit in front of Magento storefronts or block REST API uploads; the fix is the APSB26-73 update plus server cleanup.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Disclosure

    Sansec publishes PolyShell research: unauthenticated file upload via the Magento REST guest cart API; no patch for production lines.

    Sources:Sansec: PolyShell, unrestricted file upload in Magento and Adobe Commerce·Akamai: Magento PolyShell, the latest Magento threat

  2. First observed

    Sansec reports 471 stores compromised in one hour via PolyShell webshells followed by injected JavaScript loaders.

    Source:Sansec: Mass PolyShell attack wave hits 471 stores in one hour

  3. Vendor action

    Adobe APSB26-73 assigns CVE-2026-48356 (critical, CVSS 9.3) and ships -2026-jul releases for supported lines.

    Sources:Adobe APSB26-73: Security update available for Adobe Commerce·NVD CVE-2026-48356

  4. Update

    Sansec observes the same crew moving its CMS block loader to deepveindrilling.com, mostly on stores it already controlled.

    Source:Sansec: deepveindrilling.com Magento CMS block loader hits 953 stores

  5. Update

    CISA adds CVE-2026-48356 to the Known Exploited Vulnerabilities catalog (2026.10.27), due 2026-11-10.

    Sources:CISA KEV catalog entry for CVE-2026-48356·NVD CVE-2026-48356

  6. Update

    HOL publishes an operator write-up with patch, folder block and webshell hunt commands.

    Source:HOL: Magento PolyShell (CVE-2026-48356) is on CISA KEV

Publication clock: 5398.3 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • magento/product-community-edition (Magento Open Source)@<=2.4.9, <=2.4.8-p5, <=2.4.7-p10, <=2.4.6-p15 (fixed in -2026-jul releases)composerpackage
  • Adobe Commerce@<=2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 (fixed in -2026-jul releases)composerpackage

Indicators

Published values are defanged so nothing here is copy-paste executable. These are inert text, never links.

  • domainhigh confidencedefanged
    deepveindrilling[.]com
  • domainhigh confidencedefanged
    lanhd6549tdhse[.]top

Sources

Every claim on this record is traceable to the sources below.

Related reviewed records

Records this one was reviewed against. Every relationship below is part of a released revision, with the reviewer’s stated reason.

Campaign questions, answered

CVE-2026-48356, named PolyShell by Sansec, is an unrestricted file upload (CWE-434) in Adobe Commerce and Magento Open Source. The REST guest cart endpoints POST /rest/V1/guest-carts/:cartId/items and PUT /rest/V1/guest-carts/:cartId/items/:itemId accept a file_info object (base64 data, MIME type, filename) inside cart item custom options and write it to pub/media/custom_options/quote/. HOL Guard tracked the campaign from Mar 17, 2026 to Oct 27, 2026.

No. Active tracking ended Oct 27, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 8 primary sources, names 2 reviewed artifacts, and was last fully reviewed Oct 27, 2026 by HOL Guard Security Publishing. Its 2 indicators are published defanged, as inert text that cannot be followed or executed. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. CISA does not publish the evidence behind KEV entries. Adobe's APSB26-73 bulletin still states Adobe is not aware of exploits; exploitation evidence comes from Sansec's research.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-A50559D9