Magento PolyShell on KEV: guest-cart uploads and post-patch hunt notes

On 27 Oct 2026, CISA added CVE-2026-48356 to the Known Exploited Vulnerabilities catalog: unrestricted upload of a file with dangerous type in Adobe Commerce and Magento Open Source. The same alert also listed Brotli / Node2Shell CVE-2026-111497 — do not conflate the two.

Adobe’s APSB26-73 (14 Jul 2026) is the vendor fix train (-2026-jul builds). Sansec’s PolyShell write-up (17 Mar 2026, with later updates) named the issue and documented the guest-cart REST upload path and post-exploitation patterns researchers observed.

This post is engagement sequencing. Use Adobe for versions; use Sansec for mechanism and hunt cues — attribute their telemetry to them.

Snapshot

Adobe’s bulletin still states Adobe was not aware of in-the-wild exploits for APSB26-73 issues at publication. CISA’s Oct KEV listing is the active-exploitation signal for operators now. Sansec reported mass probing/uploads earlier in 2026 — cite Sansec if you reference that volume; do not paste percentages as your own finding.

Why KEV in October for a July patch matters mid-engagement

Patch availability ≠ clean estate. On authorized e-commerce assessments:

• “We applied July security” still leaves files already on disk and secondary backdoors outside custom_options/
• RCE is configuration-dependent (whether the web server executes PHP under media). Upload success alone is not proof of RCE
• GraphQL is a different code path — Sansec states GraphQL mutations are not vulnerable; do not claim GraphQL RCE from this CVE

Industry noise says “Magento KEV.” Engagement state asks: is Commerce/Magento in ROE, which train, and what is already under pub/media/custom_options/?

Triage questions

1. In ROE? Magento / Adobe Commerce storefront or admin explicitly authorized?
2. Which train? Against APSB26-73 -2026-jul (or later) — not “Magento 2” as a brand.
3. Guest REST reachable? /rest/.../V1/guest-carts/.../items exposure on the in-scope host?
4. Media execution? Does nginx/Apache pass .php under pub/media/custom_options/ to FastCGI?
5. What do you pause? Unfinished AD/web paths with evidence deserve a clean pause note — including unfinished work while Node2Shell is also in the news.

Operator path

Evidence worth capturing

• Exact Commerce/Magento version string and whether -2026-jul (or newer security release) is present
• Presence/absence of unexpected .php / .phtml / .phar under pub/media/custom_options/ (Sansec hunt cue)
• Web-server rules for that directory (deny / php_flag engine 0 vs PHP handler winning)
• If IR-authorized: scattered accesson.php under invented assets/images/ trees; CMS/static-block skimmer domains Sansec lists — only report what you observe
• Do not treat Adobe’s UI:R CVSS note as “needs a phishing click” without checking the unauthenticated guest-cart API path researchers describe

Client-facing remediations (short)

• Apply APSB26-73 -2026-jul (or current Adobe security release) for the installed train; upgrade Commerce Events to 1.21.0+ if used
• Deny web execution/access under pub/media/custom_options/ (Sansec/nginx/Apache examples — verify against the client’s real vhost)
• Hunt for planted polyglots and secondary backdoors even after patch
• WAF rules that only block directory reads do not stop API uploads — patch + disk hunt still required

What not to write

• Bundling this with Node2Shell as one “Oct 27 KEV” finding
• “All Magento is RCE” without media-execution evidence
• Reciting Sansec store percentages as your measured scope
• Completeness claims (“all stores checked”) without inventory
• Invented skimmer attribution without CMS/filesystem evidence

Primary sources: CISA KEV alert (27 Oct 2026), APSB26-73, and Sansec PolyShell. Re-verify fixed versions there before you file.