PolyShell Vulnerability - Attacks Target Magento Stores

The Flaw

The PolyShell vulnerability is a serious issue affecting Magento version 2 and Adobe Commerce installations. Discovered recently, this flaw allows attackers to exploit Magento’s REST API, which handles file uploads for cart items. By manipulating this feature, hackers can execute remote code or take over accounts through stored cross-site scripting (XSS). This vulnerability was publicly disclosed just days before mass exploitation began, highlighting the urgency for affected stores to take action.

According to eCommerce security firm Sansec, attacks leveraging PolyShell started on March 19, 2026, just two days after the vulnerability was made public. As of now, over 56% of vulnerable Magento stores are being targeted. This alarming statistic underscores the critical nature of the vulnerability and the need for immediate attention from store owners.

What's at Risk

The risk associated with the PolyShell vulnerability is significant. If exploited, it can lead to remote code execution (RCE), allowing attackers to gain unauthorized access to sensitive data and systems. This could result in the theft of customer information, financial data, and potentially the complete compromise of the affected online store.

Moreover, the vulnerability's exploitation is not just limited to data theft. Attackers can also deploy malicious scripts, such as payment card skimmers, which can capture sensitive payment information from unsuspecting customers. This is particularly concerning for eCommerce platforms, where trust and security are paramount.

Patch Status

Adobe has acknowledged the PolyShell vulnerability and released a fix in version 2.4.9-beta1 on March 10, 2026. However, this patch has not yet reached the stable branch, leaving many stores vulnerable. The delay in providing a stable update raises concerns about the security of Magento users who rely on timely patches to protect their systems.

Despite attempts to contact Adobe for clarification on the rollout of a stable security update, no response has been received. Store owners are left in a precarious situation, needing to balance immediate protective measures with the hope of a forthcoming patch.

Immediate Actions

For Magento store owners, immediate action is crucial to mitigate the risks posed by the PolyShell vulnerability. Here are some recommended steps:

• Update to the latest version of Magento as soon as the stable patch is available.
• Monitor your systems for any signs of compromise or unusual activity, especially around payment processing.
• Implement security measures such as web application firewalls (WAF) to help filter out malicious traffic.
• Educate your team about the importance of security best practices, including regular updates and vigilance against suspicious activity.

By taking these proactive steps, store owners can better protect their businesses and customers from the potential fallout of the PolyShell vulnerability.