On Tuesday, Oct. 27, the U.S. Cybersecurity and Infrastructure Security Agency added an Adobe Commerce and Magento vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is CVE-2026-48356, which researchers call "PolyShell." Federal civilian agencies have until Nov. 10 to address it. Most online stores aren't federal agencies, but they should treat that date as their own deadline too. The reason is simple: according to the e-commerce security firm Sansec, a single operator has been using PolyShell and related bugs to plant malicious code in hundreds of Magento storefronts, and that campaign is still running.
The catch for store owners is that patching isn't the whole job. Sansec says it found the attacker's loader on a store that had every core patch installed. A store that was compromised before it was patched may still carry the attacker's access.
What PolyShell Is
The National Vulnerability Database record describes CVE-2026-48356 as an "unrestricted upload of file with dangerous type" weakness (CWE-434). That's a long way of saying the application accepts a file it should have refused, such as a script disguised as something harmless. Once that file is on the server, it can run arbitrary code in the context of the current user.
Adobe and NVD both give the flaw a CVSS 3.1 base score of 9.3, which is rated critical. The vector string shows how it works. It can be exploited over the network, it's low in complexity, and it needs no privileges. It does require some user interaction, and its "scope changed" rating means a successful attack can reach beyond the vulnerable component itself. The impact on confidentiality and integrity is rated high. No availability impact is listed. In practice, that's the profile of a bug used to take over a site quietly, not one used to crash it.
The NVD record was published July 14, 2026, and the fixed builds are the "-2026-jul" releases delivered in Adobe security bulletin APSB26-73. CISA's KEV listing came more than three months after the NVD record. Sansec had already linked PolyShell to a mass attack wave in March, when it reported 471 stores infected in one hour.
The Campaign: 953 Stores and Counting
In a report published Oct. 24, Sansec described a group that has compromised 953 online stores since July 2025, most of them running Magento. The group adds a small piece of JavaScript, a "loader," to the store's CMS blocks. Sansec says earlier waves of the campaign point to Magento file-upload flaws such as PolyShell as the way in.
CMS blocks are reusable chunks of content, such as banners, footers and promo snippets, that Magento keeps in its database and displays across the storefront. Sansec says the loader lives in the cms_block table, not in a file on disk, so checking code files alone will not find it. Because the block is rendered into storefront pages, the loader appears wherever the block is used.
Sansec says the loader is selective: the server checks whether a visitor is a real shopper or a security scanner, and scanners get nothing. When the urlscan.io service loaded an infected store with an automated Chrome browser, Sansec found no added content in the page.
The newest piece of infrastructure is a domain called deepveindrilling.com. It was registered Oct. 6, 2026, and the first stores began loading it the following day. Sansec found it in the CMS blocks of 83 stores. It's the fifth loader domain the group has used, and 60 of those 83 stores had already been running one of the earlier loaders. In other words, most of the shops hit by the new domain had been compromised before, and the attacker updated the code it had left behind.
The operation can also move fast. Sansec reports that in March, the operator injected the loader into 471 stores in one hour, after uploading webshells (small backdoor scripts that give remote control of a server) through PolyShell.
What the Loader Delivers Is Still Unknown
The researchers are careful about what they can prove. The Hacker News, reporting on Sansec's findings, notes that the loader is designed to fetch and execute an attacker-controlled payload, but that no next-stage malware has been recovered, so the campaign's end goal is unclear. Sansec says it has not captured the final payload of the newest loader. It did observe earlier payloads served to real visitors through a traffic-distribution system, including a script from a domain imitating the Ledger crypto wallet brand in December 2025. What the current loader delivers remains unconfirmed. The Hacker News also reports that the activity has been going on since at least July 2025.
None of the sources attribute the campaign to a named group or country, and CISA's KEV entry lists ransomware use as "Unknown."
Patched Isn't the Same as Clean
The most useful finding in Sansec's report may be what its eComscan tool turned up. Across the campaign, it found the loader on 169 Magento 2 installations that were missing at least one core patch. Of those, 102, or 60 percent, also had files that had been uploaded through PolyShell or through SessionReaper (CVE-2025-54236), an older Magento bug. On 3,024 comparable installs with a different skimmer, Sansec puts that rate at 32 percent.
Then there's the outlier. One store was running 2.4.7-p10 with no missing core patches, and it still received deepveindrilling.com at 16:46 UTC on Oct. 23, one hour after a clean scan. Sansec says eComscan had found a rogue admin account on that store on Sept. 16 and a GSocket backdoor on Sept. 24. The broader point: once an attacker has a webshell, database access or a rogue admin account, installing a patch closes the door they came through but doesn't remove them. As Sansec puts it, deleting the injected script does not remove the attacker's database access.
What It Means for Defenders
Who is affected. According to NVD, vulnerable versions include:
- Adobe Commerce through 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18
- Adobe Commerce B2B through 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17 and 1.3.3-p18
- Magento Open Source through 2.4.9, 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15
- Adobe Commerce Events through 1.20.0
The fixed releases are the "-2026-jul" builds of each version line and Commerce Events 1.21.0, all delivered through Adobe bulletin APSB26-73.
Patch both entry points. Sansec recommends installing APSB26-73 for PolyShell and APSB25-88 for SessionReaper (CVE-2025-54236). Sansec ties both bugs to this operator's activity. Federal civilian agencies face CISA's Nov. 10 due date. The KEV entry requires applying the vendor's mitigations in line with CISA's BOD 26-04 guidance, or discontinuing use of the product if mitigations are unavailable.
Assume compromise if you were exposed. If your store ran a vulnerable build at any point before you applied APSB26-73, check it, not just its version number:
- Review the content of your CMS blocks and pages for script tags or references to external domains you don't recognize. Remember that the loader lives in the database, not in your code repository.
- Look for files in upload and media directories that don't belong there, especially anything executable or disguised as an image.
- Check the
admin_usertable for unfamiliar administrator accounts, as Sansec advises. - Compare what you find against the indicators of compromise Sansec published in its report.
- Because the loader hides from scanners, don't treat a clean external scan as proof that the store is clean.
Rotate after cleanup. Sansec advises that after cleanup you change the database, admin and API integration passwords, because removing the script alone leaves the attacker's database access in place. Doing the rotation after cleanup is a sensible ordering: rotating while a webshell is still on the server risks handing the attacker the new credentials.
For CMMC and federal contractors. The KEV due date applies to federal civilian agencies, not directly to contractors. Still, a KEV listing gives a dated reference point. If you operate a Magento or Adobe Commerce storefront in scope, it is reasonable to record the patch date, the compromise check and the credential rotation as separate actions.
CISA added a second flaw to KEV the same day: a Brotli vulnerability, CVE-2026-111497, rated CVSS 9.2, according to The Hacker News. Teams working through this week's KEV additions should account for both.
