Magento and Adobe Commerce, October 2026

Magento stores are being hacked through CVE-2026-48356. Here's what to do.

On 27 October 2026, the US cyber agency CISA added CVE-2026-48356, a Magento flaw known as PolyShell, to its list of flaws that attackers are using right now. Adobe fixed it in July 2026, but stores that never updated are open, and even updated stores can still carry a backdoor from an earlier break-in. If you run a store on Magento Open Source or Adobe Commerce, here is how to check your version, what to update to, what to look for, and when to get help.

Ask us to check your store Jump to the steps

Published 28 October 2026Last updated 28 October 2026Written by the Penguina team

What happened

A file upload flaw in Magento, now used in real attacks.

CVE-2026-48356 lets an attacker upload files to a Magento or Adobe Commerce store without permission. Adobe rates it 9.6 out of 10 and fixed it in its security bulletin APSB26-73 on 14 July 2026.

On 27 October 2026, CISA added it to its Known Exploited Vulnerabilities list. That list only holds flaws with evidence of real attacks. US federal agencies must fix it by 10 November 2026. For everyone else, that date is a useful signal of how urgent it is.

What Sansec found

Sansec, a company that researches attacks on online stores, published its findings on 24 October 2026. By its count:

953 stores have had hidden scripts planted by one criminal group since July 2025, most of them on Magento.
New waves of attacks came on 7 and 23 October 2026.
Fully patched stores were infected again, because the attackers had left backdoors and admin accounts of their own behind.

These numbers are Sansec's. Nobody else has published a count.

Which versions are affected

Is your store on an affected version?

From Adobe's bulletin APSB26-73. You can see your version at the bottom of any page in your store's admin panel.

Affected

Magento Open Source:

2.4.9
2.4.8-p5 and earlier
2.4.7-p10 and earlier
2.4.6-p15 and earlier

Adobe Commerce:

2.4.9
2.4.8-p5 and earlier
2.4.7-p10 and earlier
2.4.6-p15 and earlier
2.4.5-p17 and earlier
2.4.4-p18 and earlier

Adobe Commerce Events extension: 1.6.0 to 1.20.0.

Fixed

Adobe's July 2026 security release for your line, or any later release:

Magento Open Source:

2.4.9-2026-jul
2.4.8-2026-jul
2.4.7-2026-jul
2.4.6-2026-jul

Adobe Commerce:

2.4.9-2026-jul
2.4.8-2026-jul
2.4.7-2026-jul
2.4.6-2026-jul
2.4.5-2026-jul
2.4.4-2026-jul

Adobe Commerce B2B: 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul or 1.3.3-2026-jul.

Adobe Commerce Events extension: 1.21.0.

The bulletin only covers the versions listed. If your store runs something older, such as Magento 1 or an early 2.4 release, Adobe lists no fix for it. Talk to your developer about moving to a supported version.

Adobe's bulletin, written in July, still says Adobe is not aware of attacks. CISA's listing on 27 October and Sansec's research are newer, and both say attacks are happening.

What to do today

Three steps for store owners.

If a developer or agency looks after your store, send them this list. Updating closes the hole. Step 2 matters just as much, because an update does not remove anything an attacker already left behind.

Check your version, then update

Log in to your store's admin panel; the version shows at the bottom of the page. If it is on the list above, take a full backup, then install Adobe's July 2026 security release for your line, or anything newer.

Look for what was left behind

Open System > Permissions > All Users and remove any account nobody on your team recognises. Ask your developer to check upload folders, content blocks and the checkout for files or scripts nobody added. Sansec's write-up explains what to look for.

Change every password

Store admin, hosting, SFTP/SSH and database. Then turn on two-factor login for every admin user.

Black Friday is on 27 November 2026. If you planned to freeze changes before then, do the update and the checks first.

What we don't know

What nobody has said yet.

What the hidden scripts finally do: Sansec has not captured the last stage of the attack. So nobody can say for sure that card details were stolen, and we don't claim it.
How many stores in total: 953 is Sansec's count for one group. Other stores may be affected.
Whether your store was touched: only a check of your own store can tell.

We'll update this page when Adobe, CISA or Sansec publish more.

When to get help

Get help now if any of these are true.

You found an admin user, file or script nobody on your team added.
Your store is on an affected version and you can't update it yourself.
Customers report odd pop-ups, payment pages or emails from your store.
Nobody is looking after your store right now.

We look after small business websites in the US, UK, Canada and Australia. Your first fix is free. Start a chat and tell us your store address.

Questions

Questions store owners ask.

Something else? Ask in the chat or email hello@penguina.website.

Is my Magento store affected by CVE-2026-48356?

It is if it runs an affected version: Magento Open Source 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, or 2.4.6-p15 and earlier, or Adobe Commerce on those lines plus 2.4.5-p17 and earlier and 2.4.4-p18 and earlier. The fix is Adobe's July 2026 release for your line, such as 2.4.8-2026-jul. Adobe's bulletin APSB26-73 lists the exact versions. You can see your version at the bottom of your store's admin panel.

Is CVE-2026-48356 really being used in attacks?

Yes. On 27 October 2026, CISA added it to its Known Exploited Vulnerabilities list, which only holds flaws with evidence of real attacks. Sansec reports new attack waves on 7 and 23 October 2026. Adobe's bulletin, written in July, still says Adobe is not aware of attacks.

I already installed the July 2026 update. Am I safe?

The update closes the hole, but it does not remove anything an attacker left before you updated. Sansec found fully patched stores that were infected again through backdoors and admin accounts the attackers had left behind. Check your admin users and look for files or scripts nobody added.

What is the 10 November 2026 date?

It is the date by which US federal agencies must fix CVE-2026-48356, set by CISA when it listed the flaw on 27 October 2026. It doesn't apply to private stores, but it shows how urgent the fix is.

Were my customers' card details stolen?

Nobody can say that yet. Sansec has not captured the last stage of the attack, so what the hidden scripts finally do is unknown. If you find a script nobody added on your store, get help to remove it and find out what it did.

My store runs an older Magento version. What now?

Adobe's bulletin only covers the versions it lists. For older versions, such as Magento 1 or an early 2.4 release, Adobe lists no fix. Talk to your developer about moving to a supported version, and check your store for unknown admin users and files in the meantime.

Does this affect Shopify, WooCommerce or other platforms?

No. CVE-2026-48356 is a flaw in Magento Open Source and Adobe Commerce only.

Keep reading

Sources for this page