CISA Adds PolyShell and Brotli Flaws to KEV Amid Exploitation Reports
Summary
CISA added Adobe Commerce/Magento’s PolyShell flaw and Brotli-related CVE-2026-111497 to its KEV catalog. Reports describe ongoing PolyShell attacks and Brotli exploit traffic; vendors issued fixes, with FCEB agencies’ deadline set for November 10.
Key points
- CISA added CVE-2026-48356 (PolyShell), affecting Adobe Commerce and Magento, and Brotli-related CVE-2026-111497 to its KEV catalog, citing evidence of active exploitation.
- Sansec reported that attackers used PolyShell to breach hundreds of e-commerce stores and inject a loader through a Magento CMS block. The activity is assessed to date back to at least July 2025; no next-stage malware has been recovered.
- Previdian recorded one CVE-2026-111497 exploitation attempt against its honeypot sensors as of October 27, 2026. ELLIO separately reported exploit traffic carrying a public exploit it said achieved a shell on vulnerable builds.
- The Brotli flaw can affect applications that decompress attacker-controlled Brotli data with node:zlib; reported potential impacts include crashes, sensitive process-memory disclosure or remote code execution, depending on exposure.
- Node.js fixed the flaw in versions 22.23.4, 24.22.1 and 26.12.1; the cited advisory offers no workaround. PHP and several other projects and vendors also released fixes or assessed exposure.
- Wiz warned that 91% of cloud environments had resources vulnerable to CVE-2026-111497 and 82% had publicly exposed Node.js instances. FCEB agencies have until November 10, 2026, to apply fixes for the two flaws.
Article Details
- Vulnerability Types
- Brotli decoder process-memory corruption
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- available
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 94[.]154[.]43[.]7 | ELLIO reported exploit traffic originating from this IP address, including a Node2Shell exploitation attempt. |
MITRE ATT&CK
T1105 · Ingress Tool TransferThe loader injected through a Magento CMS block is designed to fetch an attacker-controlled payload.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2026-48356 to breach e-commerce stores and CVE-2026-111497 against vulnerable Brotli-decoding applications.
CVE
CVE-2026-111497As for CVE-2026-111497 (aka Broccoli2Shell, HTTP2Shell, and Node2Shell), telemetry data from threat intelligence firm Previdian shows that one exploitation attempt has been recorded against its honeypot sensors from aCVE-2026-48356The development comes days after Sansec said it observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.
Vendors
AdobeCybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV)GoogleSecurity Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active
Products
Adobe Commerceand Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV)BrotliAgency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of activeMagentoInfrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citingNode.jsthat an application decompresses with node:zlib can corrupt process memory," Rapid7 said. "According to Node.js, this corruption can lead to a process crash, disclosure of sensitive process memory, or remote code
Countries
Netherlandson vulnerable builds." The activity originates from "94.154.43[.]7," an IP address geolocated to the Netherlands that has also engaged in exploitation efforts targeting PHP2Shell, two critical flaws in PHP that couldUnited StatesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities