WORLDTECHCISA Adds Adobe Commerce and Brotli Flaws to KEV Catalog Amid Active Exploitation
The Cybersecurity and Infrastructure Security Agency has placed two flaws in Adobe Commerce and Magento, together with a flaw in Google's Brotli decoder library, into its Known Exploited Vulnerabilities catalog, citing evidence that they are being actively exploited.
Three flaws listed as exploited
On Tuesday, the Cybersecurity and Infrastructure Security Agency, known as CISA, added two vulnerabilities affecting Adobe Commerce and Magento, and one in Google's Brotli decoder library, to its Known Exploited Vulnerabilities catalog. The agency based the listing on evidence of active exploitation, according to the report.
The Brotli flaw, tracked as CVE-2026-111497 and scored 9.2 on the CVSS scale, is an unchecked return value vulnerability. As described, a remote attacker without authentication could use a crafted Brotli-compressed stream to tamper with adjacent decoder memory, expose sensitive memory contents, trigger a denial-of-service condition or potentially run arbitrary code.
PolyShell campaign against online stores
The Adobe Commerce and Magento flaw, CVE-2026-48356 with a CVSS score of 9.3, involves unrestricted upload of a file with a dangerous type. It could allow arbitrary code execution in the context of the current user and may grant elevated access or control over a victim's account or session.
Days before the catalog update, Sansec reported that attackers had used this flaw, known as PolyShell, to breach hundreds of e-commerce stores and insert a malicious loader through a Magento CMS block. The loader is designed to retrieve and execute an attacker-controlled payload, yet no next-stage malware has been recovered so far, making the campaign's precise objectives difficult to establish. The activity is assessed to have been ongoing since at least July 2025.
Early signs of Brotli exploitation
Telemetry from the threat intelligence firm Previdian recorded one exploitation attempt against its honeypot sensors from a U.S.-based IP address as of October 27, 2026. The flaw is also known as Broccoli2Shell, HTTP2Shell and Node2Shell. It is not yet known whether these efforts are broad in scope.
Rapid7 noted that exposure depends on whether an application passes attacker-controlled compressed data to the affected decoder. According to Node.js, the memory corruption can cause a process crash, disclosure of sensitive process memory or remote code execution. Separately, activity has been traced to an IP address geolocated to the Netherlands that has also targeted PHP2Shell, two critical PHP flaws that can enable unauthenticated remote code execution.
Open questions
- What payloads, if any, will the PolyShell campaign ultimately deliver?
- How widespread is exploitation of the Brotli flaw beyond the single recorded attempt?