CISA Adds Adobe Commerce, Brotli to KEV After Active Attacks

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on October 27: CVE-2026-48356, a critical file-upload flaw in Adobe Commerce and Magento, and CVE-2026-111497, a high-severity memory corruption vulnerability in Google’s Brotli decoder library. Federal agencies have until November 10 to remediate both.

Adobe Commerce: active campaign, not a theoretical risk

CVE-2026-48356 (CVSS 9.3, critical) is an unrestricted file upload vulnerability in Adobe Commerce and Magento. An unauthenticated attacker can upload a malicious file and achieve remote code execution. Adobe patched the flaw; the NVD record dates to July 14.

Sansec and Rapid7 tracked the PolyShell campaign exploiting this vulnerability. The campaign injects a loader through a Magento CMS block, which then fetches and executes an attacker-controlled payload. Sansec documented activity back to at least July 2025. Hundreds of stores have been confirmed breached; no next-stage malware has been recovered and attributed yet, leaving the campaign’s ultimate objective open.

If you run Adobe Commerce or Magento and have not applied the patch, this is the one to move on today. EPSS sits at 0.31 but the campaign makes that number academic: exploitation is confirmed and widespread.

Earlier Adobe Commerce vulnerabilities hit the same attack surface. CVE-2026-71362 was under active exploitation in August; a CVSS 10 Magento zero-day tracked as StyleSmuggler followed in September. Adobe Commerce has been a consistent target across the year.

Brotli decoder: wide blast radius, limited exploitation so far

CVE-2026-111497 is in Google’s brotli decoder library. A crafted Brotli-compressed stream can corrupt adjacent decoder state memory, allowing a remote unauthenticated attacker to disclose memory contents, cause denial of service, or reach arbitrary code execution. The library ships as a dependency inside Node.js, Python, PHP, .NET, Bun, and other widely distributed runtimes. Wiz reported 91% of cloud environments include at least one vulnerable resource.

Confirmed exploitation is narrower than that exposure number implies. ELLIO observed attempts from a Netherlands-based IP carrying the public exploit. One of the observed attempts used a broken payload. That limits current blast radius but CISA’s KEV designation reflects where this is headed.

Patched versions, per vendor advisories:

• Node.js: 22.23.4, 24.22.1, 26.12.1
• PHP: 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1

Python, .NET, and Bun users: check your runtime vendor’s advisory for the updated Brotli dependency.

Priority

Patch Adobe Commerce first. PolyShell is a running campaign, the exploit is mature, and the blast radius is proven. Brotli is second: the scope across runtimes makes it a serious exposure even with limited exploitation today, and EPSS at 0.55 reflects the probability trajectory.

The CISA November 10 deadline applies to federal systems. Any organization running internet-facing Commerce/Magento instances or public-facing Node.js and PHP services should treat that timeline as the floor.

---

Sources: CISA KEV catalog, NVD CVE-2026-48356, NVD CVE-2026-111497, Sansec, Rapid7, ELLIO, Wiz.