A file upload in Adobe Commerce and Magento Open Source needs no login, no account and no admin access. CISA added it to the Known Exploited Vulnerabilities catalog on 27 October, which means the window for quietly patching it in a maintenance slot has closed.
What happened
The flaw is tracked as CVE-2026-48356, an unrestricted upload of a file with a dangerous type. Adobe rates it 9.6; NVD scores it 9.3. It was fixed in the July 2026 release set published as bulletin APSB26-73, which Adobe shipped on 14 July and which still states the vendor was not aware of in-the-wild exploitation at the time.
The mechanics are specific. A store's REST API accepts a file as part of a cart item's custom options, and the anonymous guest-cart routes POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId require no authentication. The upload path checks only for an image header, so a polyglot file that is a valid GIF or PNG and also contains PHP passes. The plugin never verifies that the product actually offers a file option, and it never rejects .php, .phtml or .phar extensions. Files land under pub/media/custom_options/quote/.
Whether the dropped file executes depends on the web server. Stock nginx on older Magento builds, any nginx configuration that passes every .php file to the PHP handler, and older Apache setups without php_flag engine 0 will run it. Where execution is blocked the file still sits on disk, ready to become live after a migration or a configuration change.
Sansec, which documented the technique under the name PolyShell, said the flaw has been used at scale since March, with one wave compromising 471 stores inside an hour. The research firm has linked the same loader infrastructure to at least 953 compromised storefronts since July 2025.
Who is affected
- Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier
- Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier
- Adobe Commerce B2B through 1.5.3, plus the Commerce Events connector through 1.20.0
- Any host where the web server executes PHP from the store's pub/media directory
What to do now
Patch the store, then hunt for what the patch does not remove. The July update closes the upload path; it does not delete a shell that is already on disk.
- Upgrade to the matching 2026-jul release for your line: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul or 2.4.4-2026-jul. Commerce Events needs 1.21.0.
- List pub/media/custom_options/quote/ and look for .php, .phtml, .phar or double-extension files. Anything you cannot account for is a webshell until proven otherwise.
- Check web and CDN logs for requests to files in that directory that returned 200.
- Rotate admin passwords and invalidate active admin sessions once the upload path is closed.
- Search for loader domains already tied to this crew, including deepveindrilling.com and additionalver.com, in page content and stored CMS blocks.
What this means for South African businesses
Most local online stores are built on WooCommerce, but the Magento and Adobe Commerce installs that do exist tend to belong to larger retailers who treat the store as their only revenue channel, and they are usually several release lines behind. A shell in the media directory survives the patch, so an unpatched-then-patched store can still be handing out card skimming code months later. If nobody has actually opened that directory and read it since July, assume the store is unverified rather than clean.
Source: CISA Known Exploited Vulnerabilities update, 27 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.