CISA Flags Exploited Adobe Commerce and Brotli Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-48356 in Adobe Commerce and Magento, and CVE-2026-111497 in Google’s Brotli decoder library. The Adobe flaw, known as PolyShell, has a CVSS score of 9.3; the Brotli issue has a score of 9.2.
Sansec reported that attackers have used PolyShell to breach hundreds of e-commerce stores. The campaign, active since at least July 2025, injects a malicious loader through a Magento CMS block. That loader is intended to retrieve and execute an attacker-controlled payload, although no second-stage malware had been recovered at the time of the report.
PolyShell puts commerce platforms at risk
CVE-2026-48356 is an unrestricted upload of a file with a dangerous type vulnerability in Adobe Commerce and Magento. Successful exploitation can lead to arbitrary code execution in the context of the current user and may give an attacker elevated access or control of an account or session.
The observed CMS-block injection matters because it provides attackers with a mechanism to load code after compromising a store. The absence of a recovered next-stage payload does not establish the campaign’s ultimate objective, but it does not reduce the significance of active exploitation against e-commerce deployments.
Brotli exploit traffic reaches internet-facing targets
CVE-2026-111497 affects the Google Brotli decoder library. An unauthenticated remote attacker could use a crafted Brotli-compressed stream to corrupt adjacent decoder-state memory, disclose sensitive memory, cause a denial of service, or potentially execute arbitrary code.
Previdian recorded one exploitation attempt against its honeypot sensors from a U.S.-based IP address by October 27, 2026. ELLIO separately said its sensors saw exploit traffic from an IP address geolocated in the Netherlands. It described the payload as a correctly structured Node2Shell attempt for Node v24.22.0, matching public tooling and indicating adoption by an operator focused on mass exploitation.
Rapid7 noted that risk depends on whether an application passes attacker-controlled compressed data to the affected decoder through node:zlib. Node.js said memory corruption can cause a crash, disclosure of sensitive process memory, or remote code execution. Sysdig added that Express 5 with default JSON parsing places many instances in the affected group, while patch priority should follow reachability.
Patch supported releases and check exposure paths
The issue has prompted patching and assessment work across products that use Brotli, including PHP, Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and Ruby’s brotli gem. PHP released versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1. Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1.
Akamai said there is no workaround in the Node.js advisory, making an upgrade the only complete remediation; organizations on discontinued lines should move to a supported release line. Wiz estimated that 91% of cloud environments have resources vulnerable to CVE-2026-111497 and that 82% have publicly exposed Node.js instances.
For businesses, the immediate task is to inventory Adobe Commerce, Magento, and Brotli-consuming services; patch supported versions; and verify whether untrusted uploads or compressed input can reach vulnerable code. FCEB agencies must apply fixes for both flaws by November 10, 2026, underscoring the urgency of addressing confirmed exploitation.