Skip to content
CVE-2026-48356 CrowdStrike LogScale · LogScale

Detect Adobe Commerce and Magento Unrestricted File Upload to Web Shell (CVE-2026-48356) in CrowdStrike LogScale

Detects exploitation of CVE-2026-48356, an unrestricted upload of a file with a dangerous type (CWE-434) in Adobe Commerce, Adobe Commerce B2B and Magento Open Source (APSB26-73) that can lead to arbitrary code execution. The CVE is on the CISA KEV catalog (added 2026-10-27, BOD 26-04) and Sansec reports mass attack waves that drop PHP web shells under pub/media. Detection uses the web-server and WAF telemetry each platform already has: requests that fetch or execute script files (.php, .phtml, .phar) from pub/media, and a PHP or web server worker spawning a shell on the host.

MITRE ATT&CK

Tactic
Initial Access Persistence Execution

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(php-fpm[0-9.]*|php-cgi|httpd|apache2|nginx)$/i
| ImageFileName=/(\\|\/)(sh|bash|dash|curl|wget|nc)$/i
| table([@timestamp, ComputerName, ParentBaseFileName, ImageFileName, CommandLine])
high severity low confidence

CrowdStrike CQL (Falcon) search for a shell or download tool started by the PHP or web server process that runs Magento, the follow-on to a dropped web shell. Falcon has no HTTP request telemetry, so this covers the host side only.

Data Sources

Falcon sensor process telemetry

Required Tables

ProcessRollup2

False Positives & Tuning

  • Deployment or cron scripts run through PHP
  • Image optimisation tools called by the store

Other platforms for CVE-2026-48356

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.

  1. Test 1 Request a script path under pub/media (lab)

    Expected signal: A web access log line with a GET for /pub/media/catalog/product/test-cve-2026-48356.php.

Last updated: Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the host runs Adobe Commerce, B2B or Magento Open Source at a version listed in APSB26-73.
  2. List requests for .php, .phtml or .phar files under pub/media with source IP and status code, and find the matching upload request just before.
  3. Check the file on disk: owner, creation time and content (eval, base64_decode, system calls).

Containment

  1. Apply the Adobe fix from APSB26-73 and follow BOD 26-04 guidance.
  2. Until patched, block execution of script files under pub/media in the web server config and block the attacking sources at the WAF.
  3. Remove confirmed web shells only after copying them for forensics, then rotate admin, database and API credentials.

Evidence Collection

  1. Preserve web server and WAF logs for the full exposure window.
  2. Copy dropped files, the Magento var/log and report directories and the admin_user table.
  3. Capture process trees and outbound connections of the PHP workers.

Escalation Criteria

  • !Escalate to incident response if a script file under pub/media returned 200 or a PHP worker spawned a shell.
  • !Escalate if payment pages show injected JavaScript (Magecart-style skimming).
  • !Escalate if the store is internet-facing and unpatched.

Investigation Guide

Forensic Artifacts

  • >Web server access logs for script files under pub/media
  • >New or modified .php, .phtml and .phar files in upload directories
  • >Process creation events whose parent is php-fpm or the web server

Tuning Guidance

Web logs show the dropped shell being used, not always the upload itself, so the media-script rules are the high-signal ones. Add your own upload directories, exclude known scanners, and keep the CrowdStrike process rule as a low-confidence backstop. Patching is the definitive fix.

Hunting Queries

Daily POST volume to upload-capable Magento paths per client, to find the source of a malicious upload since the 2026-07-14 disclosure.

Hunting — KQL
kql 
// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
CommonSecurityLog | where TimeGenerated > ago(14d) | where RequestMethod == "POST" | where RequestURL has_any ("/media/", "/customer/", "/rest/") | summarize Posts = count() by SourceIP, bin(TimeGenerated, 1d) | order by Posts desc
Hunting — SPL
spl 
``` df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence ```
index=web earliest=-14d http_method=POST (uri_path="*/media/*" OR uri_path="*/customer/*" OR uri_path="*/rest/*") | timechart span=1d count by src

Atomic Red Team Tests

Test 1 Request a script path under pub/media (lab)
linux

Sends a GET for a non-existent .php path under pub/media to a lab Magento or web server so the access log shows the pattern the rules match. It does not exploit the vulnerability. Run only against a lab host.

Command

bash 
curl -s -o /dev/null -w "%{http_code}\n" http://localhost/pub/media/catalog/product/test-cve-2026-48356.php

Cleanup

bash 
echo "no cleanup required"

Expected Telemetry

A web access log line with a GET for /pub/media/catalog/product/test-cve-2026-48356.php.

Expected Detection

The KQL, SPL, EQL, AQL, Sumo and YARA-L rules match on the path; the CrowdStrike rule does not fire.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0003 Persistence TA0002 Execution ATT&CK Matrix

Related Techniques

T1190 Exploit Public-Facing Application T1505.003 Web Shell T1059 Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections