Skip to content
CVE-2026-48356 Elastic Security · Elastic

Detect Adobe Commerce and Magento Unrestricted File Upload to Web Shell (CVE-2026-48356) in Elastic Security

Detects exploitation of CVE-2026-48356, an unrestricted upload of a file with a dangerous type (CWE-434) in Adobe Commerce, Adobe Commerce B2B and Magento Open Source (APSB26-73) that can lead to arbitrary code execution. The CVE is on the CISA KEV catalog (added 2026-10-27, BOD 26-04) and Sansec reports mass attack waves that drop PHP web shells under pub/media. Detection uses the web-server and WAF telemetry each platform already has: requests that fetch or execute script files (.php, .phtml, .phar) from pub/media, and a PHP or web server worker spawning a shell on the host.

MITRE ATT&CK

Tactic
Initial Access Persistence Execution

Elastic Detection Query

Elastic Security (Elastic)
eql 
// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
any where event.category == "web" and url.path regex~ "/(pub/)?media/.*\\.(php[0-9]?|phtml|phar)"
high severity medium confidence

EQL rule for requests to script files under the Magento media directory in web access logs ingested by the Elastic nginx, Apache or IIS integrations.

Data Sources

Elastic nginx, Apache and IIS integrations (url.path, http.response.status_code)

Required Tables

logs-nginx.access-*logs-apache.access-*logs-iis.access-*

False Positives & Tuning

  • Legitimate static assets named with a script extension (rare in pub/media)
  • Security scanners and penetration tests against the storefront

Other platforms for CVE-2026-48356

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.

  1. Test 1 Request a script path under pub/media (lab)

    Expected signal: A web access log line with a GET for /pub/media/catalog/product/test-cve-2026-48356.php.

Last updated: Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the host runs Adobe Commerce, B2B or Magento Open Source at a version listed in APSB26-73.
  2. List requests for .php, .phtml or .phar files under pub/media with source IP and status code, and find the matching upload request just before.
  3. Check the file on disk: owner, creation time and content (eval, base64_decode, system calls).

Containment

  1. Apply the Adobe fix from APSB26-73 and follow BOD 26-04 guidance.
  2. Until patched, block execution of script files under pub/media in the web server config and block the attacking sources at the WAF.
  3. Remove confirmed web shells only after copying them for forensics, then rotate admin, database and API credentials.

Evidence Collection

  1. Preserve web server and WAF logs for the full exposure window.
  2. Copy dropped files, the Magento var/log and report directories and the admin_user table.
  3. Capture process trees and outbound connections of the PHP workers.

Escalation Criteria

  • !Escalate to incident response if a script file under pub/media returned 200 or a PHP worker spawned a shell.
  • !Escalate if payment pages show injected JavaScript (Magecart-style skimming).
  • !Escalate if the store is internet-facing and unpatched.

Investigation Guide

Forensic Artifacts

  • >Web server access logs for script files under pub/media
  • >New or modified .php, .phtml and .phar files in upload directories
  • >Process creation events whose parent is php-fpm or the web server

Tuning Guidance

Web logs show the dropped shell being used, not always the upload itself, so the media-script rules are the high-signal ones. Add your own upload directories, exclude known scanners, and keep the CrowdStrike process rule as a low-confidence backstop. Patching is the definitive fix.

Hunting Queries

Daily POST volume to upload-capable Magento paths per client, to find the source of a malicious upload since the 2026-07-14 disclosure.

Hunting — KQL
kql 
// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
CommonSecurityLog | where TimeGenerated > ago(14d) | where RequestMethod == "POST" | where RequestURL has_any ("/media/", "/customer/", "/rest/") | summarize Posts = count() by SourceIP, bin(TimeGenerated, 1d) | order by Posts desc
Hunting — SPL
spl 
``` df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence ```
index=web earliest=-14d http_method=POST (uri_path="*/media/*" OR uri_path="*/customer/*" OR uri_path="*/rest/*") | timechart span=1d count by src

Atomic Red Team Tests

Test 1 Request a script path under pub/media (lab)
linux

Sends a GET for a non-existent .php path under pub/media to a lab Magento or web server so the access log shows the pattern the rules match. It does not exploit the vulnerability. Run only against a lab host.

Command

bash 
curl -s -o /dev/null -w "%{http_code}\n" http://localhost/pub/media/catalog/product/test-cve-2026-48356.php

Cleanup

bash 
echo "no cleanup required"

Expected Telemetry

A web access log line with a GET for /pub/media/catalog/product/test-cve-2026-48356.php.

Expected Detection

The KQL, SPL, EQL, AQL, Sumo and YARA-L rules match on the path; the CrowdStrike rule does not fire.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0003 Persistence TA0002 Execution ATT&CK Matrix

Related Techniques

T1190 Exploit Public-Facing Application T1505.003 Web Shell T1059 Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections