CISA adds exploited Adobe Commerce and Brotli flaws to KEV
Original title: Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
CISA added CVE-2026-48356 in Adobe Commerce and Magento and CVE-2026-111497 in Google's Brotli decoder to its Known Exploited Vulnerabilities catalog. Sansec says attackers used the upload flaw, called PolyShell, to breach hundreds of stores and inject a loader through a Magento CMS block, with no next-stage malware recovered. Previdian and ELLIO report Brotli exploit attempts, including a public exploit aimed at Node.js 24.22.0. Federal civilian agencies must fix both flaws by November 10, 2026.
Unconfirmed: Campaign goals are unclear because no next-stage malware was recovered, and how broad the Brotli attacks are is not settled.
- CVE-2026-48356 scores 9.3; CVE-2026-111497 scores 9.2.
- Node.js fixes are 22.23.4, 24.22.1, and 26.12.1.
- PHP shipped 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1.
- ELLIO saw exploit traffic from 94.154.43.7 in the Netherlands.
- Wiz says 91% of cloud environments have vulnerable resources.
Impact: Arbitrary code execution on stores and via crafted Brotli data
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Commerce | — | — |
| Adobe Magento | — | — |
| Google Brotli | — | — |
| Node.js | — | 22.23.4, 24.22.1, and 26.12.1 |
| PHP | — | 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 |
- 1.Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1.
- 2.Apply the listed PHP releases and other vendor Brotli patches.
- 3.Federal civilian agencies must remediate both flaws by November 10, 2026.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 94.154.43.7 | shell on vulnerable builds." The activity originates from " 94.154.43[.]7 ," an IP address geolocated to the Netherlands that has a |
From the original article
3 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.