CISA Flags Actively Exploited Adobe and Brotli Flaws

The U.S. Cybersecurity and Infrastructure Security Agency added two vulnerabilities to its Known Exploited Vulnerabilities catalog on Tuesday, saying there is evidence of active exploitation. One flaw affects Adobe Commerce and Magento, and the other affects Google's Brotli decoder library.

The Adobe Commerce and Magento bug, CVE-2026-48356 with a CVSS score of 9.3, allows unrestricted upload of a dangerous file type and can lead to arbitrary code execution in the current user's context. Security firm Sansec said attackers exploited the flaw, also known as PolyShell, to compromise hundreds of online stores and plant a loader through a Magento CMS block. The loader fetches and executes an attacker-controlled payload, but no second-stage malware has been recovered, so the campaign's goals remain unknown. Sansec assesses the activity has been ongoing since at least July 2025.

The Brotli flaw, CVE-2026-111497 with a CVSS score of 9.2, is an unchecked return value vulnerability that a remote unauthenticated attacker can trigger with a crafted Brotli-compressed stream to corrupt decoder state memory, disclose sensitive memory, cause a denial of service, or possibly execute arbitrary code. By October 27, 2026, threat intelligence firm Previdian had seen one exploitation attempt hit its honeypot sensors from a U.S.-based IP address. It is not known whether that activity is broad.

On Monday, ELLIO said its sensors detected CVE-2026-111497 exploit traffic that included the public exploit, and the company verified the code can obtain a shell on vulnerable builds. The traffic originated from IP address 94.154.43.7 in the Netherlands, which has also targeted PHP2Shell flaws in PHP that can lead to unauthenticated remote code execution. ELLIO said the payload was a correct Node2Shell exploitation attempt for node v24.22.0, identical to public tooling, indicating an operator focused on mass exploitation. Rapid7 explained that according to Node.js, the memory corruption "can lead to a process crash, disclosure of sensitive process memory, or remote code execution".

Vendors have released patches because Brotli is widely distributed. PHP released versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, while fixes or advisories are listed for Node.js, Bun, Envoy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and Ruby's brotli gem. Akamai said Node.js fixed the flaw in versions 22.23.4, 24.22.1, and 26.12.1, and because the Node.js advisory provides no workaround, users must upgrade to fully remediate. According to Wiz, which Google owns, 91% of cloud environments contain resources vulnerable to CVE-2026-111497, and 82% have Node.js instances that are publicly exposed. Sysdig said attacks have so far caused crashes at scale and code execution only in a narrow configuration, so organizations should patch systems where attacker-influenced Brotli data reaches the decoder.

Federal Civilian Executive Branch agencies have until November 10, 2026, to apply fixes for both flaws.