Who this is for: businesses running online stores on Adobe Commerce (formerly Magento Commerce) or Magento Open Source, the agencies that build and maintain them, and hosting providers. This article is based on public information from Adobe, CISA and NVD, and on reports from an e-commerce security company. It does not cover attack steps or exploit code.
続報待ち：この記事は公式発表に合わせて更新します
As of October 28, 2026 (Japan time)まだ分かっていないこと
- Confirmation of exploitation by Adobe (the bulletin still says it is not aware)
- Alerts from Japanese public agencies (none from JPCERT/CC or IPA)
- Victims among stores in Japan (none disclosed)
CISA added the flaw to KEV on October 27. Adobe's fix came out on July 14. Details of the exploitation come from an e-commerce security company's reports, which Adobe has not confirmed. We will update this article when there are new announcements.
What to do today
Check your version and whether the fix is applied
Run bin/magento --version on the store's server to check the version. The July fix is distributed as an isolated patch applied on top of the latest security release of each line (for example, 2.4.7-p10). To check whether it is applied, use the Quality Patches Tool (vendor/bin/magento-patches -n status) on environments hosted by Adobe, and on other environments the Commerce Version Tool bundled with the fix (available after the CE patch is applied) (Adobe's release notes). If an agency or maintenance company runs your store, ask them about both points.
Apply the fix
Adobe's procedure is to first move to the latest security release (the -p version) of your line (2.4.9 stays as is) and then apply the July fix. The patches are not cumulative, so apply them in order. If you use the Adobe Commerce Events module, update it to 1.21.0 or later. For environments hosted by Adobe (Adobe Commerce on cloud infrastructure), Adobe says the latest Magento Cloud Patches release fixes the issue, and warns that applying the isolated patch on top of it can make installation fail. Follow Adobe's guidance.
Check the upload folders
The e-commerce security company reports that web shells were placed in pub/media/custom_options/ (especially the quote folder under it) and recommends checking pub/media/customer_address/ as well. Look for files disguised with image names and for executable files such as .php, .phtml or .phar. These folders normally hold things like files customers attach to orders.
Check CMS blocks, CMS pages and admin accounts
In the database, check the cms_block and cms_page tables for <script> tags you did not add, and for entries changed recently (update_time). The same company's report lists the strings to search for. Check admin_user for accounts you do not recognize, and check the server for unfamiliar running processes.
If you find signs, clean up and then change credentials
After removing the malicious files and scripts, change the passwords and tokens for admin accounts, the database and API integrations. Removing a script alone leaves the attacker's way back in (a web shell or an admin account). If the checkout page was touched, contact your card companies and payment provider.
Interim measures if you cannot apply the fix right away (they do not stop the attack)
The same company recommends configuring the web server to deny web access to pub/media/custom_options/ and to prevent PHP from running there. This stops uploaded files from being run from outside, but it does not stop files from being uploaded. The company says a WAF (a system that inspects web application traffic) rule is needed to block the upload requests themselves. Both are stopgaps until you apply the fix.
Affected and fixed versions
| Product | Affected | Fix (Adobe's notation) |
|---|---|---|
| Adobe Commerce | 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier | 2026-jul for each of 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.5, 2.4.4 |
| Adobe Commerce B2B | 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier | 2026-jul for each of 1.5.3, 1.5.2, 1.4.2, 1.3.4, 1.3.3 |
| Magento Open Source | 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier | 2026-jul for each of 2.4.9, 2.4.8, 2.4.7, 2.4.6 |
| Adobe Commerce Events | 1.6.0 to 1.20.0 | 1.21.0 |
"2026-jul" is not a new version number. It means the latest security release of each line with the July isolated patch applied. In Adobe's release notes, the patch files are split by target version, for example "2-4-7-p10-jul-2026.zip". Magento Open Source users can download the patches directly only for 2.4.6 and later.
Adobe's table lists 2.4.9 as affected too. The e-commerce security company writes that 2.4.9 included the fix for this flaw, but the bulletin covers 14 flaws fixed on the same day. We recommend following Adobe's table and applying the July fix on 2.4.9 as well.
The flaw that lets files be uploaded (the way in)
Fixed by the July fix (2026-jul)
Planted web shells
Not removed by the fix. Check the upload folders
Scripts injected into pages
Not removed by the fix. Check cms_block and cms_page
Added admins and possibly exposed credentials
Not removed by the fix. Check admin_user and change credentials
What was disclosed
- CVE
- CVE-2026-48356 (Adobe security bulletin APSB26-73)
- Type
- Unrestricted upload of a file with a dangerous type (CWE-434). Adobe lists the impact as privilege escalation and the severity as critical, and says no authentication is required
- Severity
- CVSS v3.1 9.6 in Adobe's bulletin table (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L). 9.3 in the value Adobe registered in the CVE record and in NVD's score (identical except A:N)
- Impact (CVE description)
- Arbitrary code execution in the context of the current user, potentially taking over the victim's account or session. It says exploitation requires the victim to open a crafted URL or interact with a compromised page
- Fix
- Published July 14, 2026 (updated August 11). The same bulletin fixes 14 vulnerabilities, and this is the only one in KEV. Adobe's priority rating is 2, the middle of three levels
- Exploitation (Adobe)
- Adobe says it is not aware of exploitation (as posted on October 28)
- Exploitation (CISA)
- Added to KEV on October 27, 2026. The deadline for US federal civilian agencies (FCEB) is November 10. Use in ransomware campaigns is "Unknown". CISA's SSVC assessment in NVD rates exploitation as "active"
The two CVSS values differ only in whether the availability impact (A) is "low" or "none". Both are in the 9 range on a 10-point scale, which is critical, and the priority does not change. The CVE description says user interaction is required (UI:R), but the company's March write-up described below says files can be uploaded without logging in. We give more weight to the KEV listing than to the details of the score (this site's view).
The other flaw CISA added to KEV on the same day is a vulnerability in the Brotli compression format (CVE-2026-111497). Organizations in Japan are not bound by the US deadline, but CISA encourages all organizations to prioritize fixing KEV vulnerabilities.
Attack reports (an e-commerce security company's research)
The following comes from a security company that specializes in investigating compromised online stores. Adobe has not confirmed it.
March 17, 2026
The company disclosed a file upload flaw in Magento and Adobe Commerce, naming it "PolyShell". It said that at the time the fix existed only in a pre-release version (a 2.4.9 pre-release)March 30, 2026
The same company reported a large-scale attack using PolyShell in which 471 stores were compromised within one hour (this report does not give a CVE number)July 14, 2026
Adobe published APSB26-73 with fixes for each supported release lineOctober 24, 2026
The company reported that web shells planted through PolyShell (CVE-2026-48356) and other flaws such as SessionReaper were used to inject JavaScript into store pages, in a campaign that has reached 953 stores in total, mostly Magento, since July 2025October 27, 2026
CISA added the flaw to KEV
According to the October 24 report, after planting web shells, the attackers injected JavaScript into the database table cms_block (the blocks shown on store pages). The script loads code from external sites that returns a redirect or further code for each visitor. The 953 stores are mostly Magento stores and include stores compromised through a different flaw (SessionReaper, CVE-2025-54236).
The report says the injected code also reached patched stores. As an example, it cites a store on 2.4.7-p10 with no missing core patches. It also says that deleting the script does not remove the attacker's access. The report does not make clear whether that access came from previously planted web shells or another route.
If PolyShell, as that company calls it, is the same as CVE-2026-48356, the March mass attack took place before Adobe released fixes for the supported lines in July (this site's inference; Adobe has not confirmed exploitation). If your store was running before July, it is safer to check for traces going back to March.
The situation in Japan
As of October 28, JPCERT/CC and IPA have not issued alerts about this flaw. Within what we have checked, no store in Japan has disclosed being affected by it.
If an injected script is placed on a checkout page, card data that shoppers enter may be exposed. The standard that stores handling card data follow is PCI DSS, and the explainer on XSS (cross-site scripting) covers how malicious scripts end up running on pages.
This site's view
The distinguishing feature of file upload flaws is that the damage continues after the fix. Planted files and injected page code remain if they were added before the fix. In this case, the flaw entered KEV three and a half months after Adobe released the fix. Stores that applied the July fix are not done either: they need to check for intrusion before the date they applied it.
For Magento, the places to check are largely fixed: the upload folders, cms_block and cms_page, and admin_user. When you ask a maintenance company to check, naming these three places and asking for the results helps avoid gaps. General defenses against file upload flaws are covered in File upload vulnerabilities.
What is still unknown
| Item | Status |
|---|---|
| Confirmation of exploitation by Adobe | The bulletin (updated August 11) still says Adobe is not aware |
| Scale of exploitation | CISA has not published details. The numbers come only from an e-commerce security company's reports |
| Whether PolyShell is this CVE | Based on that company's report. Adobe does not mention the name |
| Status of 2.4.9 | Affected in Adobe's table. The company says 2.4.9 included the fix (follow Adobe's table) |
| Victims in Japan | None disclosed |
Sources
All checked on October 28, 2026.
- Adobe, "Security update available for Adobe Commerce | APSB26-73" (published July 14, 2026, updated August 11) — adobe.com
- Adobe, "Security update available for Adobe Commerce - APSB26-73" (release notes, KA-37421) — experienceleague.adobe.com
- CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (October 27, 2026) — cisa.gov
- CISA, "Known Exploited Vulnerabilities Catalog" (data as of the October 27, 2026 version) — cisa.gov
- NVD, "CVE-2026-48356" — nvd.nist.gov
- Report by an e-commerce security company (October 24, 2026, including how to look for traces of intrusion) — sansec.io
- The same company's PolyShell write-up (published March 17, 2026, including interim measures) — sansec.io / its report on the March mass attack (March 30, 2026) — sansec.io
- JPCERT/CC, list of alerts for 2026 (Japanese) — jpcert.or.jp
Update history
2026-10-28: First version, based on public information from Adobe, CISA and NVD and on an e-commerce security company's reports.
Read next
- Defending against this type of flaw: File upload vulnerabilities: preventing web shells and RCE
- How malicious scripts end up running on pages: What is XSS (cross-site scripting)
- Deciding priority: Deciding what to patch first: CVSS, EPSS and KEV
- When a vulnerability is announced: CVE remediation playbook
- Added to KEV on the same day: Brotli vulnerability CVE-2026-111497
- Terms: What is a backdoor / What is PCI DSS / What is CVSS