CISA adds Adobe Commerce and Brotli flaws to KEV as PolyShell hits hundreds of stores

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of real-world attacks.

CVE-2026-48356 (CVSS 9.3), also known as PolyShell, affects Adobe Commerce and Magento. The platform permits unrestricted uploads of dangerous file types, which can lead to arbitrary code execution as the current user and potentially to control over the victim's account or session.

CVE-2026-111497 (CVSS 9.2) is a flaw in Google's Brotli decoder, nicknamed Broccoli2Shell, HTTP2Shell and Node2Shell. It stems from an unchecked return value. Using a crafted Brotli-compressed stream, a remote unauthenticated attacker can corrupt adjacent decoder state memory, expose sensitive memory contents, cause a denial of service, or in some cases execute arbitrary code.

Hundreds of stores breached

Days before CISA's decision, Sansec reported that attackers had used PolyShell to compromise hundreds of e-commerce stores. They injected a malicious loader through a Magento CMS block, designed to fetch and run an attacker-controlled payload. No next-stage malware has been recovered so far, so the campaign's ultimate goals remain unclear. Researchers assess that the activity has been ongoing since at least July 2025.

First Brotli attacks

According to Previdian, its honeypots had recorded one exploitation attempt against CVE-2026-111497 from a U.S.-based IP address as of October 27, 2026. Whether these efforts are broad in scope is not yet known.

ELLIO said its sensors had captured traffic carrying the public exploit, which it confirmed yields a shell on vulnerable builds. The source was 94.154.43[.]7, an address in the Netherlands previously seen targeting PHP2Shell, a pair of critical PHP flaws. ELLIO described the payload as a correctly structured Node2Shell attempt against Node.js v24.22.0, identical to public tooling, and a sign that the exploit has been picked up by an operator focused on mass exploitation.

Rapid7 noted that the risk arises when an application decompresses attacker-supplied Brotli data via node:zlib. Sysdig stressed that not every Node.js service is affected, only those decoding such data, though Express 5 with default JSON parsing places many deployments in that group. The impact shown so far is crashes at scale and code execution in a narrow configuration, so patching should be prioritized by reachability. Wiz estimates that 91% of cloud environments contain resources vulnerable to CVE-2026-111497 and 82% have publicly exposed Node.js instances.

Patches

Because Brotli is so widely used, many vendors responded urgently. PHP released versions 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. Fixes or advisories have also come from Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension and the Ruby brotli gem, as well as Red Hat, Ubuntu, Amazon Linux, Cloudflare, Cisco, Microsoft and others.

Node.js fixed the bug in versions 22.23.4, 24.22.1 and 26.12.1. Akamai pointed out that there is no workaround, so upgrading is the only complete remedy. Organizations on discontinued release lines are advised to move to supported ones.

U.S. Federal Civilian Executive Branch agencies must remediate both flaws by November 10, 2026.

Source: The Hacker News