Unauthenticated dangerous file upload in Adobe Commerce and Magento leads to arbitrary code execution (CVE-2026-48356)
CISA added this to KEV on 2026-10-27 after Sansec documented a mass attack wave against Commerce and Magento stores still on pre-July-2026 builds, so a storefront that has not applied APSB26-73 should be treated as targeted and checked for web shells now.
An unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento Open Source lets an attacker without credentials get code executed in the context of the current user, gaining control of the account or session; Adobe's vector records a user-interaction step. Sansec associates the flaw with the PolyShell mass attack wave and a CMS block loader implant on stores that did not apply the July 2026 update.
Affected: Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier; Adobe Commerce B2B 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier; Magento Open Source 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier; Adobe Commerce Events 1.6.0 to 1.20.0
How to Test
Confirm the installed release is one of the 2026-jul builds (for example 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul, or Commerce Events 1.21.0); anything older is exposed. To check for compromise, work through Sansec's indicators of compromise for the CMS block loader / DeepVeinDrilling and PolyShell campaigns (https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise): review CMS blocks for injected loader code, search web-accessible directories for recently uploaded files with executable types, and audit admin accounts and sessions for unexpected activity.
How to Patch
Upgrade per APSB26-73 to Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul or 2.4.4-2026-jul; Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul or 1.3.3-2026-jul; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul or 2.4.6-2026-jul; and Adobe Commerce Events 1.21.0.