CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Original title: U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
CISA added Google Brotli flaw CVE-2026-111497 and Adobe Commerce and Magento flaw CVE-2026-48356 to its Known Exploited Vulnerabilities catalog. The Brotli bug, also called Node2Shell, can corrupt decoder memory, expose data, cause denial of service, or potentially run code from a crafted stream. The Magento bug, called PolyShell, allows unrestricted upload and code execution as the current user. Researchers report exploit attempts against both, and Binding Operational Directive 22-01 gives federal civilian agencies until October 29, 2026, to remediate them.
Unconfirmed: The scale of Brotli exploitation is unclear, and researchers have not recovered the Magento follow-on payload, so that campaign’s objectives are unconfirmed.
- CVE-2026-111497 is rated 9.2 and CVE-2026-48356 is rated 9.3.
- Previdian recorded one Brotli attempt by October 27; ELLIO saw traffic carrying a public exploit.
- Wiz warned that 91 percent of cloud environments contain vulnerable resources and 82 percent expose Node.js.
- Sansec said PolyShell attacks infected at least 953 stores and have continued since at least July 2025.
- Node.js, PHP, Bun, and Microsoft .NET are among projects that released Brotli-related updates.
Impact: Memory exposure or code execution; Magento account or session takeover
| Product | Affected |
|---|---|
| Google Brotli | — |
| Adobe Commerce | — |
| Adobe Magento | — |
| Node.js | — |
| PHP | — |
| Bun | — |
| Microsoft .NET | — |
- 1.Federal civilian agencies must remediate both cataloged flaws by October 29, 2026.
- 2.Apply the security updates released by affected Brotli users, including Node.js, PHP, Bun, and .NET.
- 3.Check Adobe Commerce and Magento stores for a malicious CMS-block loader.
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-48356 | Unrestricted dangerous file upload in Adobe Commerce and Magento | 9.3 | 45% | KEV | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.