Google Brotli and Adobe Commerce/Magento Critical Flaws Added to CISA KEV Catalog
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced that two high‑severity vulnerabilities have been added to its Known Exploited Vulnerabilities (KEV) catalog.
- CVE‑2026‑111497 (CVSS 9.2) is an unchecked‑return‑value flaw in Google’s Brotli compression library. A remote, unauthenticated attacker can send a crafted Brotli stream that corrupts decoder memory, leaks data, triggers denial‑of‑service, or achieves arbitrary code execution. Exploitation attempts (e.g., “Node2Shell”) have been observed in the wild, and 91 % of surveyed cloud environments still host vulnerable instances.
- CVE‑2026‑48356 (CVSS 9.3), dubbed PolyShell, is an unrestricted file‑upload issue in Adobe Commerce and Magento. Attackers can upload malicious payloads via a CMS block, gaining code execution with the privileges of the current user. At least 953 online stores have been reported compromised.
Both flaws affect a broad ecosystem of web‑applications, SaaS platforms, and e‑commerce sites that rely on Brotli compression or Magento‑based storefronts. Vendors such as Node.js, PHP, Bun, and Microsoft .NET have issued patches, but many deployments remain unpatched.
Why It Matters for Trust & Control Assurance — The incidents underscore the need for a robust vulnerability‑management control that provides continuous evidence of patch status across all software components.
Who Is Affected — E‑commerce retailers, SaaS providers, cloud‑hosted web applications, and any organization that embeds Brotli or Magento in its stack.
Recommended Actions
- Inventory all assets that use Brotli or Adobe Commerce/Magento.
- Verify patch levels against vendor advisories; apply updates immediately.
- Integrate automated vulnerability scanning with continuous evidence collection for audit readiness.
- Monitor CISA KEV updates and threat feeds for emerging exploits.
Source: Security Affairs
Technical Notes
- Attack vector: Exploitation of a library‑level memory‑corruption bug (Brotli) and an unrestricted file‑upload (Magento).
- CVEs: CVE‑2026‑111497, CVE‑2026‑48356.
- CVSS: 9.2 and 9.3 respectively.
- Observed activity: Node2Shell traffic (Brotli) and PolyShell payloads targeting Magento stores.