Summary
On October 27, 2026, CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: the PolyShell file-upload flaw in Adobe Commerce and Magento, and a flaw in Google's Brotli decoder library. Federal agencies must remediate by November 10, 2026.
Adobe Commerce and Magento "PolyShell" (CVE-2026-48356)
| Attribute | Value |
|---|---|
| CVE | CVE-2026-48356 |
| CVSS | 9.3 (Critical) |
| Type | File upload leading to remote code execution |
| Fix | Adobe bulletin APSB26-73 (released July 14, 2026) |
The patch has been available for over three months, yet reporting says attacks have breached hundreds of stores, and one source says the flaw has been mass-exploited since March. See our earlier coverage: PolyShell attacks target 56% of vulnerable Magento stores.
Actions: upgrade to the APSB26-73 release for your version line, then search pub/media/custom_options for uploaded shells and unexpected files.
Google Brotli (CVE-2026-111497)
| Attribute | Value |
|---|---|
| CVE | CVE-2026-111497 |
| CVSS | 9.2 (Critical) |
| Type | Unchecked return value (CWE-252), can cause out-of-bounds write (CWE-787) |
| Affected | Brotli 1.0.3 through 1.2.0 |
The first exploit attempt reportedly hit Node.js 24.22.0, a day before CISA's listing.
Fixed versions:
- Node.js 22.23.4, 24.22.1, or 26.12.1
- libbrotli 1.0.10, 1.1.1, or 1.2.1
Restart services and rebuild containers or bundled binaries that statically include Brotli.
Recommendations
- Patch Adobe Commerce/Magento and hunt for planted files, even if you patched recently.
- Inventory Node.js runtimes and any software bundling libbrotli, then upgrade.
- Rebuild container images that pin affected Node.js versions.
- Track the November 10 CISA deadline if you are a federal agency or contractor.