CISA adds Adobe Commerce and Brotli flaws to catalog after reported exploitation

CISA adds two vulnerabilities to its catalog

The U.S. Cybersecurity and Infrastructure Security Agency added two vulnerabilities affecting Adobe Commerce, Magento and Google’s Brotli decoder library to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The listing covers CVE-2026-48356 in Adobe Commerce and Magento and CVE-2026-111497 in Brotli.

CVE-2026-48356, assigned a CVSS score of 9.3, is described as an unrestricted upload of a file with a dangerous type. It can result in arbitrary code execution in the context of the current user and potentially provide elevated access or control over an account or session. CVE-2026-111497, assigned a CVSS score of 9.2, is an unchecked return-value vulnerability in Google Brotli that can corrupt adjacent decoder-state memory, disclose sensitive memory, cause a denial of service or potentially enable arbitrary code execution through a crafted compressed stream.

PolyShell attacks reportedly affected hundreds of stores

Sansec said it observed attackers exploiting CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores. The reported attacks used a Magento CMS block to inject a malicious loader designed to fetch and execute an attacker-controlled payload.

No next-stage malware had been recovered at the time of the report, making the campaign’s precise objectives unclear. Sansec assessed that the activity had been ongoing since at least July 2025.

Brotli exploit traffic remains limited in the reviewed telemetry

Teligence firm Previdian recorded one exploitation attempt against its honeypot sensors from a U.S.-based IP address as of October 27, 2026. The scope of the Brotli exploitation was not known.

ELLIO separately reported that its sensors had recorded CVE-2026-111497 exploit traffic in the wild. It said the traffic carried a public exploit that it had confirmed could obtain a shell on vulnerable builds. ELLIO attributed the activity to an IP address geolocated in the Netherlands and described the payload as a correctly structured Node2Shell attempt for Node.js v24.22.0.

The exposure depends on whether an application passes attacker-controlled compressed data to the affected decoder, according to Rapid7. Brotli’s use across numerous projects prompted emergency responses involving patches or assessments from vendors including PHP, Node.js, Bun, Envoy Proxy, Istio, .NET, Python and ClickHouse.

The two vulnerabilities differ in confirmed activity

The Adobe Commerce flaw was associated with reported breaches of hundreds of stores and a malicious-loader campaign. By contrast, the reviewed telemetry for the Brotli flaw included a lone adversarially recorded attempt against Previdian’s honeypots as of October 27, while ELLIO reported additional exploit traffic in the wild.

Those figures describe different telemetry and do not establish that the Brotli campaign had reached the same scale as the reported PolyShell attacks. The reporting likewise did not establish how many Brotli deployments were vulnerable or successfully compromised.