Magento PolyShell alert: On Tap secures clients in 25 minutes

On 17 March 2026, eCommerce security specialist Sansec publicly disclosed PolyShell, a critical unrestricted file upload vulnerability affecting Magento Open Source and Adobe Commerce.

The flaw allows an unauthenticated attacker to upload a file containing potentially dangerous content through Magento’s REST API. Whether that upload can then lead to remote code execution or another compromise depends partly on the store’s web server configuration and how uploaded files are handled.

At the time this article was originally published on 19 March 2026, Adobe had not released a production security fix specifically for PolyShell. On Tap therefore introduced additional protective controls for the Magento and Adobe Commerce environments we manage while monitoring the issue for vendor updates.

Later development: On 14 July 2026, Adobe published APSB26-73, addressing an unrestricted file upload vulnerability identified as CVE-2026-48356. Sansec identifies CVE-2026-48356 as PolyShell. Adobe rated the vulnerability Critical with a CVSS base score of 9.6 and released July security fixes for affected supported release lines.

APSB26-73 addressed PolyShell alongside several other Adobe Commerce and Magento Open Source vulnerabilities. Adobe has since published further security updates, so merchants reviewing their environment today should follow the latest applicable Adobe guidance for their supported release line.

What is the Magento PolyShell vulnerability?

Sansec disclosed PolyShell on 17 March 2026 after identifying an unrestricted file upload issue in Magento and Adobe Commerce.

The vulnerability affects file uploads through Magento’s REST API. Sansec demonstrated that specially constructed files could pass validation and be written to Magento’s media storage.

The important distinction is that file upload does not automatically mean remote code execution on every store.

If the web server is configured to execute uploaded content from the affected media location, an attacker could potentially turn an uploaded file into executable code. Sansec also identified other possible consequences under different configurations, including stored cross-site scripting.

For merchants, the practical risk therefore depends on both the vulnerable Magento functionality and the surrounding server configuration.

At the time of the original 19 March article, the latest production security release in the 2.4.8 line was Magento and Adobe Commerce 2.4.8-p4, released on 10 March 2026.

Sansec reported that the underlying code-level fix existed in the 2.4.9 pre-release branch but had not yet been backported to the supported production release lines available at that point.

Adobe later confirmed through APSB26-73 that multiple supported Adobe Commerce and Magento Open Source release lines were affected by CVE-2026-48356.

How can PolyShell affect Magento merchants?

The immediate risk is that an attacker can place a file containing dangerous content on a vulnerable store without authentication.

What happens after that depends on the environment.

Where server configuration allows uploaded executable content to run from the affected location, exploitation can lead to a more serious compromise. A successful compromise could then expose store or customer data, allow malicious code to be added to the storefront, or provide an attacker with further access to the environment.

Sansec subsequently reported observing active exploitation of PolyShell. Adobe’s July APSB26-73 bulletin, however, stated that Adobe was not aware of exploits in the wild for the issues covered by that bulletin at the time of publication.

These statements reflect different sources of visibility: Sansec reported findings from its own security research and telemetry, while Adobe described what it was aware of when publishing its bulletin.

For merchants, potential consequences of a successful compromise can include:

• unauthorised files or code being added to the site

• customer or business data being exposed

• malicious JavaScript or other storefront modifications

• disruption while a compromised environment is investigated and cleaned

• reputational and commercial impact if customer-facing systems are affected

The severity is real, but these are potential consequences of successful exploitation rather than guaranteed effects of the vulnerability itself.

On Tap's immediate response

At the time of Sansec’s initial disclosure, there was no production Adobe security fix specifically for PolyShell.

According to On Tap’s incident timeline, we began introducing additional protective measures within approximately 25 minutes of Sansec’s public alert.

For the Magento and Adobe Commerce environments we manage, those steps included:

• introducing Web Application Firewall rules intended to reduce exposure to the vulnerable upload path

• hardening load balancer and web server configurations so uploaded files could not be executed from affected media locations

• scanning managed sites using Sansec eComscan, Sansec’s malware and compromise-detection scanner

We also reviewed file-integrity monitoring data for the environments under management.

Our AuditIQ file-integrity monitoring can flag unexpected changes to monitored files. No relevant file-integrity alerts had been generated in the managed environments reviewed at that point, and the subsequent scans did not identify PolyShell traces.

That provided evidence that the environments checked had not shown indicators of PolyShell compromise at the time of review. Monitoring and scanning, however, should not be interpreted as proof that an environment is completely immune from compromise or future exploitation.

What merchants should do now

The appropriate response today is different from the situation on 19 March because Adobe has since released official security fixes.

Adobe addressed CVE-2026-48356 in APSB26-73. The bulletin identifies it as a Critical unrestricted upload of a file with dangerous type vulnerability that does not require authentication or admin privileges.

Adobe has also issued subsequent Adobe Commerce and Magento Open Source security updates since July.

Merchants should therefore review Adobe’s current Magento and Adobe Commerce security bulletins and apply the latest applicable security update for their supported release line, rather than relying only on the original July bulletin.

Adobe’s vendor guidance should be treated as the primary remediation path.

In addition, On Tap recommends:

• confirming that the web server prevents execution of uploaded files in media directories

• reviewing WAF coverage as an additional defence rather than a substitute for vendor fixes

• scanning for suspicious or unexpected files

• reviewing file-integrity, application and web-server logs for indicators of compromise

• testing applicable security updates in staging before production deployment where the operating environment allows

Merchants that introduced temporary mitigations in March should not assume those controls remove the need for subsequent Adobe security updates.

Why defence in depth matters

PolyShell is a useful example of why eCommerce security should not depend on a single control.

A vulnerable application feature, web server configuration, WAF rule and monitoring system operate at different layers. A strong control at one layer can reduce the impact of a weakness at another, but none should automatically be treated as a replacement for an available vendor security fix.

For Magento and Adobe Commerce merchants, a practical security programme should combine:

• supported platform versions and current security updates

• secure web server and hosting configuration

• appropriate WAF controls

• file-integrity and application monitoring

• vulnerability and compromise scanning

• a documented incident-response process

On Tap uses these controls across the Magento and Adobe Commerce environments we manage and reviews them as new vendor guidance and threat information becomes available.

About On Tap

On Tap provides Magento and Adobe Commerce development, hosting, maintenance and security support for mid-market and enterprise merchants.

Our services include proactive site monitoring, infrastructure management, security reviews and support with urgent platform vulnerabilities.

If you need help reviewing your Magento or Adobe Commerce environment for PolyShell exposure or applying the relevant Adobe security update, contact the On Tap team.

You can also learn more about AuditIQ site-health and file-integrity monitoring.

A critical security vulnerability dubbed "PolyShell" has been disclosed in Magento and Adobe Commerce, putting thousands of online stores at risk. This flaw lets attackers upload malicious files disguised as images, potentially taking over entire sites within minutes. Just 25 minutes after Sansec's alert on March 17, 2026, On Tap activated immediate protective measures, keeping all our Magento clients 100% safe.

PolyShell is a critical unrestricted file upload vulnerability in Magento and Adobe Commerce, discovered by Sansec on March 17, 2026. It exploits weaknesses in REST API media gallery endpoints, specifically the "custom options" feature, where file type validation fails entirely, affecting all Magento 2 versions up to 2.4.8-p4 (and early 2.4.9 builds).

Imagine your store's product photo uploader as an unlocked door; hackers slip in dangerous files disguised as innocent images like photo.jpg. These files secretly contain harmful programs (shell.php) and land in accessible folders like /pub/media/custom_options/.

If your server isn't set up tightly, that hidden program runs like a backdoor key, giving hackers remote control of your site (called "remote code execution" or RCE). Even without full access, these bad files can steal customer data or damage your store.

These malicious files can:

• Data theft and breaches: Hackers steal customer details, credit cards, and store secrets.

• Site defacement and malware: Your homepage gets replaced with scams, viruses, or money-making schemes.

• Blacklisting and downtime: Search engines and payment processors block you, with fixes taking 72+ hours on average.

• Shared hosting spread: One hacked store infects others on the same server.

• ​Financial hits: Cleanup plus lost sales and trust.

Adobe fixed PolyShell in a pre-release version (2.4.9-alpha3+), but has not backported the patch to stable releases. On Tap won't wait for official patches across all versions; we take immediate steps ahead.

Just a few minutes after Sansec's March 17 alert (faster than most attacks), we did the following for our clients:

• Introduced Web Application Firewall rules to immediately block the ability to exploit any uploaded files

• Hardened load balancer and web server configurations as a second line of defence

• Scanned clients’ sites using Sansec ecomscan

However, we were already confident that no client had been compromised, because our AuditIQ solution has built-in File Integrity Monitoring, and this would have alerted us in real time to malicious files being created - no alerts had been generated.

The result: Zero PolyShell traces found. All On Tap Magento clients remain secure.

This lightning-fast response proves our commitment: rapid detection, immediate action, unbreakable defences. 

Vulnerabilities strike any platform, anytime, with serious consequences. Whether you're running Magento/Adobe Commerce, Shopify, WooCommerce, or custom integrations, hackers never sleep. Zero-day exploits, API flaws, and supply chain attacks can cripple your store overnight, stealing customer data, triggering blacklists, and costing thousands in recovery.

At On Tap, your store's security is our top priority. We treat your store like our own. We stay proactive across all eCommerce platforms and integrations, reacting instantly to protect your business. Our 24/7 security team uses cutting-edge monitoring to stay ahead of threats, no matter your tech stack.

We've protected hundreds of merchants from downtime and breaches through:

• Proactive site monitoring

• Secure cloud hosting setups

• Tailored security audits

Don't settle for one-off development or waiting on patches. Partner with On Tap for proactive vulnerability monitoring, custom security roadmaps, and complete eCommerce peace of mind. Your store deserves a trusted ally who acts first and keeps it unbreakable.

Also check out AuditIQ the premier monitoring solution for Magento and Adobe Commerce merchants. Security is just one of the areas that it has you covered - for example, it alerts you within seconds if there are unauthorised changes to your site code. It also directly integrates with Sansec for enhanced security alerts.