Magento Stores Under Attack: PolyShell Vulnerability Exploited in Over Half of Affected Systems
A critical vulnerability, dubbed ‘PolyShell,’ in Magento Open Source and Adobe Commerce is being actively exploited, impacting over half of all vulnerable stores. The flaw allows unauthenticated attackers to upload executable files via the REST API, potentially leading to remote code execution (RCE) and account takeover.
What is PolyShell?
PolyShell, discovered by the Sansec Forensics Team, exploits a flaw in Magento’s REST API that allows attackers to upload files disguised as images. This is achieved through the custom options feature for cart items, where the API accepts file uploads. The vulnerability affects all Magento Open Source and Adobe Commerce versions up to 2.4.9-alpha2. Sansec initially disclosed the vulnerability on March 17, 2026.
Exploitation and Impact
According to BleepingComputer, mass exploitation of PolyShell began on March 19th, just two days after public disclosure. Sansec reports that as of March 25, 2026, PolyShell attacks have been detected on 56.7% of all vulnerable stores.
The potential impact of a successful PolyShell attack includes:
- Remote Code Execution (RCE): Attackers can execute arbitrary code on the server, gaining complete control of the store. This is possible with stock nginx 2.0.0–2.2.x configurations (via index.php filename) or any version with a non-stock nginx configuration passing all .php files to fastcgi, and Apache pre-2.3.5 without php_flag engine 0.
- Account Takeover: Attackers can gain access to administrator accounts and sensitive customer data.
- Stored Cross-Site Scripting (XSS): Vulnerable versions pre-2.3.5 or those with custom web server configurations are susceptible to stored XSS attacks.
WebRTC Skimmer Deployment
Sansec has observed attackers leveraging PolyShell to deliver a novel payment card skimmer that utilizes Web Real-Time Communication (WebRTC) for data exfiltration. WebRTC uses DTLS-encrypted UDP, making it more tricky to detect than traditional HTTP-based skimming techniques, even on sites with strict Content Security Policy (CSP) controls.
The skimmer operates as a lightweight JavaScript loader, connecting to a command-and-control (C2) server via WebRTC. It bypasses security measures by embedding a forged SDP exchange and delaying execution using ‘requestIdleCallback’ to avoid detection. Sansec detected this skimmer on the e-commerce website of a car manufacturer valued at over $100 billion.
Patches and Mitigation
Adobe released a fix for PolyShell in version 2.4.9-beta1 on March 10, 2026, but this patch has not yet been released to the stable branch. As of March 25, 2026, no isolated patch exists for current production versions. The Hacker News reports that Adobe has not yet responded to inquiries regarding the availability of a production patch.
Even as Adobe provides a sample web server configuration to mitigate the risk, many stores utilize custom configurations provided by their hosting providers. Sansec recommends the following steps to protect against PolyShell:
- Restrict access to the upload directory (“pub/media/custom_options/”).
- Verify that nginx or Apache rules prevent access to the directory.
- Scan stores for web shells, backdoors, and other malware.
Indicators of Compromise
Sansec has published a list of IP addresses associated with scanning activity targeting web stores vulnerable to PolyShell. This list can be found here.