↓Skip to main content
  1. News/

Online Store on Adobe Commerce or Magento? Ask About This Flaw

·6 mins
Adobe Commerce Magento Online Store Patching Small Business
Table of Contents
A flaw in the software behind some online stores was added on October 27, 2026 to a U.S. government list of flaws that criminals are known to be using. A fix for the supported versions has been out since July 14. This post is for owners whose store runs on Adobe Commerce or Magento Open Source, and it says what to ask whoever runs the store.

What happened #

The software is Adobe Commerce and its free sibling, Magento Open Source. Some online stores run on it. Often the owner does not know, because a web developer, an agency or a hosting company set it up.

The security firm Sansec published a report on March 17, 2026. Keep in mind that Sansec sells protection for online stores. It says the store’s shopping cart accepts uploaded files without proper checks. Sansec says a stranger with no login could put a file on the store’s computer, and that on many stores the file could then be run. It says the weakness has been in the code since Magento 2 first came out. Adobe’s own bulletin also lists that no login is needed.

Sansec says it saw the first attacks on March 19. Adobe released a new version with the fix on May 12, but older versions did not get it then. Adobe fixed the older supported versions on July 14, 2026. On October 27, 2026, CISA, the U.S. government’s cyber agency, added the flaw to its list “based on evidence of active exploitation.”

The list is a signal. It does not mean your store was hit.

Why the dates matter #

About four months passed between the first attacks Sansec saw (March 19) and the fix for older versions (July 14). A store that has not had the July fix could still be open to this flaw.

There is a second point. A store that was open earlier may need a look even after the fix is on. Sansec says an uploaded file stays on the store’s computer even when the web server blocks it from running today. It warns that a later change, such as moving to a new server, could make such a file usable again.

Adobe’s bulletin says the company was “not aware of any exploits in the wild” for the issues in that update. Sansec had been reporting attacks since March, and the agency listed the flaw in October. The sources saw different things at different times. That is a reason to check, not a reason to worry.

What we do not know #

  • Whether any particular store was hit. No source gives a count of affected stores. Sansec’s figures cover only the stores it protects. It says it saw attacks on most of them by the end of March. That tells us nothing about the whole market.
  • Who is behind the attacks, and how many there are. The agency’s alert does not say.
  • How many stores are still unfixed. No source says.
  • How official descriptions fit together. One public description of the flaw says a visitor must click a crafted link. Sansec describes an upload with no login and no click. The details may be refined as more is published.

The government’s November 10 date in the list applies to U.S. federal agencies. It is not a deadline for your business. The agency does encourage all organizations to treat the items on its list as a priority.

Four questions to ask whoever runs your online store #

These are good questions to have answers to. They are not legal advice, and they do not promise any result.

1. Is our store built on Adobe Commerce or Magento Open Source, and which version? Many owners cannot answer this. The sources we read name these two products. They do not say other store software is affected. If your store runs on something else, ask the same question about that software.

2. Has the July 14 Adobe fix been put on our store? Give the person three things to look up: the flaw’s nickname, “PolyShell”; its number, CVE-2026-48356; and Adobe’s bulletin number, APSB26-73. According to Adobe’s support article, older versions got the fix as a separate patch, not an ordinary version upgrade. The same article says it is not easy to check whether the fix is in place. So “we are up to date” is worth confirming.

3. Has anyone checked the store for files that should not be there? Ask them to cover the time since March. Sansec advises searching for unexpected files and odd page content. Ask for the check, not only the fix.

4. Who tells us when the next fix comes out, and how fast do we apply it? Adobe has since published further critical fixes, on September 7 and October 13. Ask who is signed up for Adobe’s alerts. Ask what the usual delay is between a fix coming out and the store getting it.

If you do not sell online: this is not about you. But the last question applies to any software your business depends on. Your accounting program, your phones and your office computers all get fixes. Ask your IT person or provider who tells you when one comes out, and how fast it gets applied.

Take this to your next IT meeting #

Bring the four questions and write down the answers. If an answer is “we will find out,” ask for a date when you will hear back.

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check

Updates #

2026-10-27: First published, based on the sources below as of this date. We update this post as the details develop.

Sources #