Adobe Commerce / Magento CVE-2026-48356 ('PolyShell', unauthenticated file upload through the guest cart REST API, added to CISA KEV Oct 27 2026): which patch fixes it and how do I check for webshells?

What it is: CVE-2026-48356 (CVSS 9.3-9.6) is an unrestricted file upload flaw in Adobe Commerce and Magento Open Source. An unauthenticated visitor can upload a file through the guest-cart REST API and get it stored where it can run, which lets them plant a webshell and execute code on the store. Adobe fixed it in the APSB26-73 security bulletin on July 14, 2026 (and in the 2.4.9 line), and CISA added it to the Known Exploited Vulnerabilities catalog on October 27, 2026 after attacks against unpatched stores. Am I affected: - Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3, Magento Open Source 2.4.6 to 2.4.9 and the Adobe I/O Events connector for Commerce, without the APSB26-73 (July 2026) security patches or a later release. - Check: bin/magento --version, and compare your exact patch level with the fixed versions table in APSB26-73. Fix: 1. Install the APSB26-73 security release (or isolated patch) for your version line, or upgrade to a later supported release; for Adobe Commerce Cloud, deploy the patched version through your normal pipeline. 2. If you can't patch immediately, use a WAF rule to block file uploads sent to the guest cart REST endpoints (/rest/*/V1/guest-carts/*/items) and make sure the web server refuses to execute PHP from pub/media and other upload directories. After (attacks began before many stores patched): - Search pub/media (including custom_options and quote folders), pub/static and other writable directories for .php, .phtml, .phar or files with double extensions that shouldn't be there, and check web logs for POST requests to guest-cart item endpoints with file data. - Look for new admin users, changed payment or checkout JavaScript (card skimmers), and unknown cron jobs. - If you find anything, treat the store as compromised: remove webshells and skimmers, rotate admin, database, payment-gateway and integration API credentials, and follow your card-data incident process. Sources: https://helpx.adobe.com/security/products/magento/apsb26-73.html https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog https://www.sentinelone.com/vulnerability-database/cve-2026-48356/