CISA has added CVE-2026-48356 (PolyShell), a critical Adobe Commerce and Magento vulnerability, to its catalogue of exploited flaws, and attackers are already using it to infect online stores. If you sell on Magento 2 or Adobe Commerce, ask your agency today to confirm in writing that bulletin APSB26-73 is applied and to review the store.
Key facts
- CVE-2026-48356 has a CVSS score of 9.3. It is an unrestricted upload of dangerous files in Adobe Commerce and Magento that can lead to arbitrary code execution. Adobe fixes it in bulletin APSB26-73 (The Hacker News).
- CISA added it to its KEV catalogue based on evidence of active exploitation.
- A campaign active since July 2025 has infected 953 online stores, most of them on Magento (The Hacker News).
- An estimated 471 Magento stores received the malicious loader through PolyShell.
- No next-stage malware has been recovered, so the attackers' end goal is unknown.
Am I affected if my store runs on Magento or Adobe Commerce?
Yes, if the store does not have APSB26-73 applied. It makes no difference that an external agency runs it: the store is yours, and so is the risk.
The case Sansec describes shows why. It found a store on Magento 2.4.7-p1 that was still missing APSB26-73 and already had webshells disguised as PNG images in the pub/media/custom_options/quote/ folder (The Hacker News). A fairly recent version is not enough: what matters is the specific patch.
The sources give no figures for affected Spanish stores. The scope in Spain is not confirmed, but there is no reason to assume it is safe either.
How does the attack work, and why won't you see it?
Attackers use PolyShell to upload files to the server and then inject a loader into a Magento CMS block, the kind used for headers, footers or banners. The code runs when a shopper opens the site and that block is rendered.
The loader is designed to download and run an attacker-controlled payload. Because that second stage has not been recovered, nobody yet knows what it ultimately does.
The uncomfortable part: one variant fingerprints the browser to filter out bots and security scanners. Only real shoppers see the malicious code (The Hacker News). A clean scanner report, or the site looking normal when you visit it, proves nothing.
What to do today
- Email your agency or provider and ask whether the store has Adobe bulletin APSB26-73 applied. Demand the answer in writing.
- If it is not applied, have it applied today, not in the next maintenance cycle.
- Ask them to review CMS blocks (header, footer, banners) for external scripts they don't recognise.
- Have them look for suspicious files in pub/media/custom_options/, especially images that contain code.
- If they find anything, have them rotate credentials and API keys, and talk to your payment gateway. If customers' personal data is at risk, consider notifying the AEPD under the GDPR.
What it means for a small business
Running a self-hosted Magento or Adobe Commerce store comes with an obligation many small businesses delegate without checking: patching fast. Here CISA has confirmed exploitation and the campaign has been running since July 2025. If your agency takes days to tell you whether APSB26-73 is applied, that delay already tells you something about your risk.
The second lesson is that patching does not mean clean. The patch closes the door, but it doesn't remove whoever is already inside. With code that hides from scanners and an unknown end goal, the sensible approach is to treat any finding as a full server compromise, not a stray script you delete and forget.
The third is more about contracts than technology: if an agency runs your store, the agreement should set deadlines for applying critical patches and require them to tell you. If you are unsure how to frame that or want an independent review, our cybersecurity team can help.
Frequently asked questions
Is applying patch APSB26-73 enough?
No. The patch prevents new intrusions through PolyShell, but if the store was already compromised, the webshells and modified CMS blocks are still there. It needs a review.
Would my customers notice anything odd on the site?
Probably not. The code runs when the page loads, and one variant hides from bots and scanners so only real shoppers see it.
Do I have to notify the AEPD?
If the review finds an infection and customers' personal data is at risk, consider notifying the AEPD under the GDPR.
