Adobe PolyShell and Brotli CVEs Join CISA KEV

CISA added CVE-2026-48356, the Adobe Commerce and Magento upload flaw known as PolyShell, and CVE-2026-111497, a bug in Google's Brotli decoder library, to its Known Exploited Vulnerabilities catalog on Tuesday, October 27, 2026, with a federal due date of November 10. The two arrive with very different histories. Adobe shipped the fix for PolyShell on July 14, and researchers had documented attacks since March. The Brotli fix shipped on October 21, six days before the KEV entry, and it matters because the decoder sits inside Node.js, Bun, .NET, Envoy, Python and PHP builds for Windows.

CVE-2026-48356: PolyShell on Adobe Commerce and Magento

Adobe's bulletin APSB26-73, published July 14, describes an unrestricted upload of a file with a dangerous type (CWE-434) in Adobe Commerce and Magento, rated Critical and exploitable without authentication. Sansec, the store security firm that named PolyShell, explains the mechanics. The guest cart REST endpoints accept a file embedded in a cart item's custom options and write it under pub/media/custom_options/. The only check is an image-header test, which a polyglot file passes: a valid GIF or PNG that also contains PHP. Whether it then runs depends on the web server setup. Sansec lists stock nginx on 2.0.0 to 2.2.x, nginx configurations that hand every .php file to FastCGI, and Apache before 2.3.5 without php_flag engine 0 as paths to code execution. Elsewhere the file stays on disk and can still enable stored XSS.

Adobe lists Commerce, Commerce B2B, Magento Open Source and Commerce Events as affected, up to 2.4.9 on the main lines. The fixed builds carry the 2026-jul suffix, for example 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul, with Commerce Events fixed in 1.21.0. Adobe's bulletin, last updated August 11, says it was not aware of exploits in the wild. Sansec had documented live attacks since March 19 and a mass wave on March 30 that put a loader on 471 stores in one hour.

The campaign behind this week's headlines is bigger than PolyShell. On October 24 Sansec reported 953 stores infected since July 2025 with an obfuscated JavaScript loader stored in the cms_block table, and Cyber Security News and THN repeated the figure. The loader was rewritten on October 23 to fingerprint each visitor and let the server decide what to deliver, and a Keitaro traffic distribution system sits behind it. Sansec has not captured the final payload, and an earlier chain ended on a lookalike of a crypto wallet brand. No actor is named. PolyShell is one way in, not the only one: Sansec counts 169 Magento 2 installs missing at least one core patch, 102 of which also held PolyShell or SessionReaper (CVE-2025-54236) uploads, and one infected store ran 2.4.7-p10.

CVE-2026-111497: the Brotli decoder bug behind Node2Shell

Brotli is a compression library, and its decoder is bundled in far more software than most teams track. In c/dec/decode.c, a function that signals an invalid block switch had its return value ignored. Per the Node.js description, the streaming decoder treated the bad input as a request for more data and kept appending it to an eight-byte buffer, which produced an out-of-bounds write. Google scored it 9.2 on CVSS 4.0. It affects Brotli 1.0.3 through 1.2.0, and the fixed releases are 1.0.10, 1.1.1 and 1.2.1, released on October 21. The bug has gone by several names, Brotli2Shell, Broccoli2Shell, HTTP2Shell and Node2Shell.

The question is whether your software decodes Brotli data an attacker controls. In Node.js and Bun that happens when fetch() reads a response with Content-Encoding br, or when Express 5 or body-parser 2 decodes a br request body. Python's Brotli and brotlicffi packages are used by common HTTP clients whenever they are installed. Envoy and Istio are exposed only when the Brotli decompressor is enabled, and .NET only with request or HttpClient decompression or direct Brotli calls on untrusted data. Fixed releases include Node.js 22.23.4, 24.22.1 and 26.12.1, Bun 1.4.4, .NET 8.0.33, 9.0.22 and 10.0.14, Python Brotli 1.2.1 and brotlicffi 1.2.1.0, and PHP for Windows 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, which reach Brotli through the cURL extension when it decompresses responses. Node.js 20, 23 and 25 are end of life with no fix, and Node.js offers no runtime workaround.

Exploitation is real but still narrow. Imperva reported code execution on the official Node.js 24.22.0 Linux arm64 image without releasing its exploit, and a public proof of concept appeared on October 22. Early accounts said it only worked on a weakened build, while ELLIO later said it gets a shell on vulnerable builds. ELLIO's sensors logged a probe on October 25 and then exploit traffic on October 26, a Brotli-encoded request body of 23,069,983 bytes aimed at Node.js 24.22.0 from 94.154.43.7. THN notes that the same address, geolocated in the Netherlands, was also seen attacking PHP2Shell flaws. In ELLIO's own testing the observed chain never completed a command, and Tenable says it has not independently confirmed the activity. Previdian recorded one attempt against a honeypot from a U.S. address on October 27. No victim and no actor are named. Wiz estimates that 91% of cloud environments have resources vulnerable to the flaw, and Sysdig points to Express 5 with default JSON parsing as the large group, with crashes at scale and code execution so far in narrow configurations.

105 days against six

Both CVEs entered KEV on the same day, and the gap between fix and listing could hardly be wider. Adobe published its fix for CVE-2026-48356 on July 14, which is 105 days before October 27, and Sansec had logged the first attacks on March 19, 222 days before. Brotli's fix came out on October 21, six days before the listing, and the public proof of concept appeared a day later.

Two lessons follow from that. KEV lags the attacks, sometimes by months, so a store owner who waited for a catalog entry before patching Adobe's July release left the door open all summer. And a vendor statement can lag as well: Adobe's bulletin said no exploits were known while attacks were already being documented. The Brotli flaw shows the other side. A library bug that sits in dozens of products can reach KEV within a week, and the work shifts from patching one application to finding every place a Brotli decoder hides.

Reading it on VulnTracker

	CVE-2026-48356	CVE-2026-111497
Product	Adobe Commerce, Commerce B2B, Commerce Events, I/O Events, Magento Open Source, Magento	Google Brotli
Published	Jul 14, 2026	Oct 22, 2026
Score	9.3 Critical (CVSS 3.1)	9.2 Critical (CVSS 4.0, Google)
EPSS	30.6%	55.5%
KEV	Added Oct 27, due Nov 10	Added Oct 27, due Nov 10
SSVC	Active, Not automatable, Total impact	Active, Not automatable, Total impact
CWE	434	787, 252
Status	Modified	Undergoing analysis

Three details are worth a second look. First, the score for PolyShell. VulnTracker shows 9.3, as does THN, but Adobe's own bulletin lists 9.6, with a low availability impact where the VulnTracker vector shows none. Check which one your tooling uses before you compare it with other CVEs. Second, SSVC marks PolyShell Not automatable, yet Sansec reported a wave that loaded 471 stores in an hour, so the automation field understates what attackers have done. VulnTracker's description also says exploitation needs a victim to visit a crafted URL, which reads like the XSS path and differs from the direct upload Sansec describes.

Third, the Brotli record lists only versions 1.0.3, 1.1.0 and 1.2.0, while the real exposure sits in downstream products, and the 25 vendor advisories VulnTracker lists, most of them from Red Hat, are the better guide to what to patch. The Adobe record lists fixed versions per line but has no written remediation guide yet, so the next section carries the steps.

What to do before November 10

For Adobe Commerce and Magento:

Install the July 2026 release for your line. That means 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul and so on, the matching B2B builds, and Commerce Events 1.21.0. If you cannot patch yet, block the guest cart endpoints at a WAF. Sansec says blocking only the upload directory does not stop the upload, and execution in pub/media/custom_options/ should be denied as well.
Look for files and loaders. Any .php, .phtml or .phar file in pub/media/custom_options/ is a strong sign of compromise, and so is an accesson.php anywhere on the server. Query the cms_block and cms_page tables for fpCode, se_referrer and localStorage.getItem, and search content for deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click and manulfie.click.
Check for new admin users and rotate credentials. Sansec warns that deleting the injected script does not remove the attacker's access to the database. Change database, admin and API integration passwords after cleanup.

For Brotli:

Find where a decoder runs. Check Node.js, Bun, .NET, Envoy, Istio, Python packages, PHP on Windows, the Ruby brotli gem and container images, then update to the fixed releases and restart. A running process keeps the old decoder, and Bun executables, self-contained .NET apps and container images need a rebuild.
Retire end-of-life runtimes. Node.js 20, 23 and 25 get no fix, so move them to a supported line.
Use stopgaps where you cannot update. Reject Content-Encoding br at the proxy or WAF, which does not cover responses your own code fetches. Disable Brotli decoding in HTTP clients, since removing br from Accept-Encoding alone is not enough. Turn off the Brotli decompressor in Envoy and Istio, and uninstall the Python Brotli packages if nothing needs them.
Check versions the right way. ELLIO notes that Node.js applied the fix without changing the bundled version string, so process.versions.brotli reads 1.2.0 on patched and vulnerable builds alike. Check the Node.js release number.
Watch for the observed pattern. Very large Brotli-encoded request bodies, such as the 23 MB one ELLIO recorded, crashing Node.js workers, and traffic from 94.154.43.7.

Takeaway

These two CVEs ask for different kinds of work. PolyShell is an application patch that has been available since July, plus a cleanup job for any store that stayed exposed through the summer, since the loader outlives the upload that planted it. Brotli is an inventory job: the library is patched, and the effort goes into finding every runtime, container image and client that decodes Brotli data and rebuilding the ones that carry their own copy. In both cases waiting for the catalog entry was the slower path.

To see how both records fill in as scores, affected versions and remediation guides are completed, follow CVE-2026-48356 and CVE-2026-111497 on VulnTracker.