Magento's PolyShell upload bug is on KEV and still landing files on disk

CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities catalog on October 27, 2026. Federal civilian agencies have until November 10, 2026 under Binding Operational Directive 26-04. Store operators are not on that memo. They are on the same internet as the scanners that have been hitting Magento guest carts since March.

Sansec named the bug PolyShell when it disclosed the failure earlier in the year. Adobe’s July bulletin APSB26-73 scores it 9.6 critical. No authentication is required. The impact, in Adobe’s language, is privilege escalation that can become arbitrary code execution in the context of the current user, or control of a session. Plain English: a public storefront can accept a file it should never have accepted, and that file can become a foothold if the web server will run or serve it.

What failed in public terms

Magento’s REST guest-cart path lets a shopper attach a file when a product option is typed as a file. The public research says the store did not adequately gate that path. Option identity, option type, and dangerous extensions were not enforced the way a defender would expect. GraphQL cart mutations use a different code path and are outside this particular record. This desk will not describe request bodies, polyglot construction, or how to place a shell. The operational fact is enough: unauthenticated upload into store media, observed at scale.

Sansec’s public tracking put attacks across a large share of known Magento and Adobe Commerce estates, including a wave that hit hundreds of stores in a single hour. Adobe’s May release of Magento 2.4.9 closed the hole on that line. Older production trains needed the July isolated updates. A store that is still on 2.4.8-p5 or earlier without the July package is still in the audience.

Patch, then dig

Adobe’s fixed packages under APSB26-73 include Adobe Commerce and Magento Open Source builds tagged 2.4.9-2026-jul through the supported 2.4.x lines, matching B2B lines, and Adobe Commerce Events 1.21.0. Install the package your line names. Confirm the version string. The patch stops new uploads. It does not delete a file that landed last month.

After the update, treat the media tree as evidence. Look under the custom-options upload paths Magento uses for quote files. Scan for webshells and unexpected scripts with the tooling you already trust for ecommerce. Deny web execution and direct web access to those directories if your host config still allows it. A WAF rule that blocks guest-cart file payloads can reduce noise while you finish the upgrade. It is not a substitute for the Adobe package, and it does not clean disk.

Why ecommerce keeps learning this lesson

A checkout API that accepts files without a login is a public write path dressed as a shopping feature. Hosting defaults matter. A stock configuration that refuses to execute uploads is not the same as a custom nginx or Apache layout that cheerfully hands .php to FastCGI. Sansec’s point, restated without the method: many stores do not run the sample config Adobe publishes, and files that sit quietly today become active when someone migrates the box.

If you run Magento Open Source or Adobe Commerce for revenue, this is not a Friday afternoon ticket. Apply APSB26-73, confirm the build, restrict the upload directories, and assume compromise until the media tree says otherwise. November 10 is the federal due date. The operational date was the first week someone else’s guest cart started writing into yours.

This briefing relies on CISA’s Known Exploited Vulnerabilities catalog, Adobe’s APSB26-73 bulletin, and public reporting by Sansec. It does not include exploit procedures or proof-of-concept detail.