Adobe Commerce upload flaw used to break into hundreds of stores, Sansec says

Oct 28, 7:00 a.m. ET

Affected: Adobe Commerce and Magento Open Source 2.4.9 and earlier patch releases, Adobe Commerce B2B 1.5.3 and earlier, and Adobe Commerce Events before 1.21.0. All versions and fixes

A flaw in Adobe Commerce and Magento Open Source, , lets attackers upload executable files to a store, and CISA added it to its KEV catalog on Oct 27. Sansec, which found the flaw and calls it PolyShell, says attackers used it to plant web shells and inject a JavaScript loader into store pages. One wave hit 471 stores in one hour on Mar 30. Adobe’s update APSB26-73, released Jul 14, fixes it for supported release lines.

Sansec says the flaw is in Magento’s REST API, which accepts a file with a cart item’s custom options without checking the option or the file’s extension. Its guest cart routes need no sign-in, and uploads land in pub/media/custom_options/quote/. Whether a file then runs as code depends on the web server’s setup, Sansec says. Adobe’s CVE record says exploitation needs a victim to visit a crafted URL or a compromised page.

Sansec says it saw the first attempts on Mar 16 and mass scanning from Mar 19. It ties the Mar 30 wave to a group it has tracked since July 2025 on 953 stores, mostly Magento. On Oct 24, Sansec said the group’s newest loader domain had reached 83 stores since Oct 7.

The loader sits in the store’s CMS blocks and asks the group’s server what to send each visitor, and Sansec hasn’t captured the final payload. It says deleting the script doesn’t remove the attacker’s access. One store with every core patch got the loader on Oct 23, weeks after Sansec found a rogue admin account and a backdoor on it.

CVE: In KEV since Oct 27, 2026: CVE-2026-48356
Vendor: Adobe

What to do

5 steps

1Install Adobe’s APSB26-73 update for the Adobe Commerce, Adobe Commerce B2B or Magento Open Source release line in use, and Adobe Commerce Events 1.21.0.
2Look for files other than .htaccess in pub/media/custom_options/, and for anywhere in the document root, as Sansec advises.
3Search the cms_block and cms_page tables for fpCode, se_referrer and localStorage.getItem, the loader code patterns Sansec lists.
4Check admin_user for accounts you don’t recognize, and after cleanup change the database, admin and API integration passwords, as Sansec advises.
5Make the web server deny access to pub/media/custom_options/. Sansec says this stops uploaded files from running, though not from being uploaded.

Affected and fixed versions

Product	Affected	Fixed
Adobe Commerce	`2.4.9`, `2.4.8-p5`, `2.4.7-p10`, `2.4.6-p15`, `2.4.5-p17`, `2.4.4-p18` and earlier	The July 2026 release for each line, such as `2.4.9-2026-jul`
Magento Open Source	`2.4.9`, `2.4.8-p5`, `2.4.7-p10`, `2.4.6-p15` and earlier	The July 2026 release for each line, such as `2.4.9-2026-jul`
Adobe Commerce B2B	`1.5.3`, `1.5.2-p5`, `1.4.2-p10`, `1.3.4-p17`, `1.3.3-p18` and earlier	The July 2026 release for each line, such as `1.5.3-2026-jul`
Adobe Commerce Events	Before `1.21.0`	`1.21.0`

Product
Adobe Commerce
Affected
2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier
Fixed
The July 2026 release for each line, such as 2.4.9-2026-jul
Product
Magento Open Source
Affected
2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier
Fixed
The July 2026 release for each line, such as 2.4.9-2026-jul
Product
Adobe Commerce B2B
Affected
1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 and earlier
Fixed
The July 2026 release for each line, such as 1.5.3-2026-jul
Product
Adobe Commerce Events
Affected
Before 1.21.0
Fixed
1.21.0

Indicators

Domains copy defanged. Use Copy raw for queries.

Type	Value	Note
Domain		Loader domain on stores since Oct 7, per Sansec
Domain		Traffic distribution domain on stores from June 2026, per Sansec
Domain		Loader domain in the Mar 30 wave, per Sansec
File name		Backdoor Sansec found after PolyShell uploads

DomainLoader domain on stores since Oct 7, per Sansec
DomainTraffic distribution domain on stores from June 2026, per Sansec
DomainLoader domain in the Mar 30 wave, per Sansec
File nameBackdoor Sansec found after PolyShell uploads

Timeline

Mar 16Sansec sees the first attempts to exploit the flaw.
Mar 30Attackers put a JavaScript loader on 471 stores in one hour, Sansec says.
Jul 14Adobe releases APSB26-73, fixing supported release lines.
Oct 7The group’s newest loader domain first appears on stores, Sansec says.
Oct 27CISA adds the flaw to KEV with a Nov 10 due date.

Sources

Sansec research on PolyShellPrimary source sansec.io
Adobe advisoryPrimary source adobe.com
Sansec research on the loader campaignPrimary source sansec.io
Sansec research on the Mar 30 wavePrimary source sansec.io
CISA KEV catalogPrimary source cisa.gov
CVE recordPrimary source cve.org