Adobe Commerce and Brotli Vulnerabilities Added to CISA's KEV Catalog Amidst Active Exploitation
CISA has added two critical vulnerabilities, one affecting Adobe Commerce and Magento (CVE-2026-48356) and another in Google's Brotli decoder library (CVE-2026-111497), to its Known Exploited Vulnerabilities catalog due to active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. The vulnerabilities impact Adobe Commerce and Magento, and Google's Brotli decoder library, with both receiving critical severity ratings.
The first, CVE-2026-48356, dubbed "PolyShell," is an unrestricted file upload vulnerability in Adobe Commerce and Magento. Rated with a CVSS score of 9.3, it allows remote unauthenticated attackers to achieve arbitrary code execution within the context of the current user. This could lead to elevated access, control over victim accounts, or session hijacking. Security firm Sansec recently observed attackers leveraging this flaw to breach hundreds of e-commerce stores, injecting a malicious loader via Magento CMS blocks. The exploitation activity has been ongoing since at least July 2025, though the ultimate goals of the attackers remain unclear as no specific next-stage malware has been recovered.
The second vulnerability, CVE-2026-111497, affects Google's Brotli decoder library and is known by several aliases including "Broccoli2Shell," "HTTP2Shell," and "Node2Shell." With a CVSS score of 9.2, it stems from an unchecked return value that can allow a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial-of-service, or potentially execute arbitrary code. Rapid7 noted that exploitation can lead to process crashes, sensitive memory disclosure, or remote code execution, depending on whether an application decodes attacker-controlled compressed data.
Telemetry data from threat intelligence firm Previdian has recorded at least one exploitation attempt against its honeypot sensors originating from a U.S.-based IP address. Further analysis from ELLIO confirmed exploit traffic in the wild targeting CVE-2026-111497, originating from an IP address in the Netherlands that has also been involved in exploiting PHP2Shell vulnerabilities. The observed exploitation attempts for Node2Shell are described as genuine and correctly structured, indicating adoption by an operator focused on mass exploitation.
The widespread nature of the Brotli library, used across numerous projects, has prompted an urgent response from various vendors. Patches and advisories have been released for affected software including PHP, Node.js, Bun, Envoy Proxy, Istio, .NET, Python, and others. Node.js, for instance, has released updates for versions 22.23.4, 24.22.1, and 26.12.1, with upgrading being the sole complete remediation as no workarounds are provided.
Google-owned Wiz has highlighted the significant exposure, warning that 91% of cloud environments have resources vulnerable to CVE-2026-111497, and 82% have publicly exposed Node.js instances. Sysdig clarified that Node2Shell affects services that decode attacker-influenced Brotli, with Express 5 using default JSON parsing placing many instances at risk. The immediate impact observed includes large-scale crashes and code execution in specific configurations, suggesting that patching priority should align with reachability.
Federal Civilian Executive Branch (FCEB) agencies have been given a deadline of November 10, 2026, to implement the necessary fixes for both vulnerabilities. The inclusion of these flaws in the KEV catalog mandates that federal agencies apply patches to prevent further exploitation.
These vulnerabilities represent a dual threat to e-commerce platforms and broader software ecosystems. The Adobe Commerce flaw highlights ongoing risks in e-commerce security, while the Brotli vulnerability underscores the interconnectedness of software supply chains and the potential for a single library flaw to impact a vast array of applications and services.
CISA has officially added CVE-2026-111497, also known as Node2Shell, to its Known Exploited Vulnerabilities (KEV) catalog. This move follows observations by security firms Imperva and ELLIO of active exploitation attempts against honeypots, with one attempt even utilizing a non-functional exploit, indicating growing threat actor interest in this critical Brotli vulnerability.