Mass Exploitation of PolyShell Vulnerability in Magento Stores

• •CVE-2026-48356 allows unauthenticated file uploads to Magento stores.
• •471 stores were compromised in a single hour due to PolyShell exploitation.
• •No isolated patch exists for current production versions of affected systems.

Sansec has reported a mass exploitation wave of the PolyShell vulnerability (CVE-2026-48356) affecting Magento and Adobe Commerce stores. Attackers are exploiting this critical flaw to upload executable files via the REST API, with 471 stores compromised in just one hour. The vulnerability allows unauthenticated attackers to bypass validation by using a polyglot technique. As of October 27, 2026, the CVE has been added to CISA's Known Exploited Vulnerabilities catalog due to. Sansec has been monitoring the situation and has noted that new victims continue to emerge every minute. The attack involves injecting obfuscated JavaScript into compromised stores, which persists using localStorage. Adobe has released a patch for the 2.4.9 pre-release version, but no isolated patch exists for production versions. Many stores are still vulnerable due to custom web server configurations.