CVE-2026-48356: Adobe Commerce/Magento "PolyShell" Unrestricted File Upload

CVE-2026-48356 is an unrestricted file upload vulnerability (CWE-434) in Adobe Commerce and Magento Open Source that lets an attacker who can get a logged-in user to visit a crafted URL upload a dangerous file and execute code in that user's context, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-27 after researchers documented a mass-exploitation campaign — nicknamed "PolyShell" — that used it to plant webshells on hundreds of stores within a single hour.

CVE-2026-48356 is an unrestricted upload of file with dangerous type vulnerability (CWE-434) in Adobe Commerce and Magento Open Source. NVD's description states it "could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session," and that "exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page" (NVD).

NVD's own analysis and Adobe's CNA submission agree on CVSS v3.1 9.3 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N — network-reachable, low complexity, no privileges required, scope changed, with high confidentiality and integrity impact and no availability impact (NVD).

CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-27, with a required-action due date of 2026-11-10 under BOD 26-04; the KEV entry flags it for forensic-triage requirements but lists known ransomware-campaign use as "Unknown" (CISA KEV).

Adobe's own security bulletin (APSB26-73), which NVD cites as the fix reference, returned HTTP 403 when fetched for this page, so the exact per-branch fixed-version numbers are drawn from NVD's CPE configuration data instead of the vendor page directly: every Adobe Commerce/Magento patch level from 1.3.3 through 2.4.9 listed above is marked vulnerable in that data (NVD).

Security researcher Sansec, who NVD cites as a reference, documented the exploitation directly: in one campaign wave, "the operator injected the loader into 471 stores in one hour, after uploading webshells through PolyShell (CVE-2026-48356)," with attackers planting "PolyShell webshells disguised as PNG images" in the catalog's custom-options upload path and then injecting malicious JavaScript loaders into CMS block content for persistence. The same research explicitly ties the fix to Adobe's bulletin: "Install APSB26-73 for PolyShell" (Sansec — Magento CMS Block Loader "DeepVeinDrilling").

A related Sansec writeup on the mass-exploitation wave itself (without naming the CVE directly) describes the scale: "471 stores in a single hour" compromised on 2026-03-30, with "new victims... every minute," via a fully automated chain from file upload to JavaScript injection, loading payloads from a domain registered only four days earlier (Sansec — PolyShell Mass Attack Wave).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.30582 (98.231st percentile), consistent with a vulnerability under active, automated mass exploitation (FIRST EPSS).

Any Adobe Commerce or Magento Open Source installation on an affected patch level should apply APSB26-73 immediately and check for signs of the webshell/CMS-block-injection pattern Sansec describes, given the documented automated mass exploitation.

• Unrestricted upload of a dangerous file type lets an attacker execute code in the victim's context once the victim visits a crafted URL or compromised page (CWE-434). — NVD
• CVSS v3.1 base score is 9.3 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, agreed by both NVD and the Adobe CNA submission. — NVD
• Added to the CISA KEV catalog on 2026-10-27, due date 2026-11-10 under BOD 26-04; known ransomware-campaign use is listed as "Unknown." — CISA KEV
• Affected: every Adobe Commerce/Magento Open Source patch level from 1.3.3 through 2.4.9 per NVD CPE data; Adobe's bulletin APSB26-73 (vendor page, not fetched directly here due to HTTP 403) is the fix reference. — NVD
• Nicknamed "PolyShell"; used to upload webshells disguised as PNG images and inject malicious JavaScript loaders into CMS block content, with the campaign injecting 471 stores in one hour; Adobe's fix is APSB26-73. — Sansec Research
• EPSS score is 0.30582 (98.231st percentile) as of 2026-10-27. — FIRST EPSS