Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog on Tuesday, citing active exploitation of flaws in Adobe Commerce and Google's Brotli decoder library.
The vulnerabilities are CVE-2026-111497 and CVE-2026-48356. CVE-2026-48356 is an unrestricted file upload flaw in Adobe Commerce and Magento that allows a remote attacker to execute arbitrary code in the context of the current user. CVE-2026-111497 is an unchecked return value vulnerability in Google's Brotli decoder that can corrupt adjacent decoder state memory, potentially leading to a denial-of-service or remote code execution.
Security firm Sansec reported that attackers have been leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores. The attackers inject a malicious loader via a Magento CMS block, designed to fetch and execute an attacker-controlled payload. The activity is assessed to be ongoing since at least July 2025, and no next-stage malware has been recovered to date.
The Brotli flaw, known by several names including Broccoli2Shell and Node2Shell, is being actively exploited. Telemetry data from threat intelligence firm Previdian recorded one exploitation attempt against its honeypot sensors from a U.S.-based IP address as of October 27, 2026. ELLIO also reported exploit traffic originating from an IP address in the Netherlands, confirming the use of a public tool to gain a shell on vulnerable builds.
The fact that Brotli is a widely distributed open-source library has prompted an emergency response. Various vendors, including PHP, Node.js, Bun, Envoy Proxy, and Microsoft .NET, have released patches or advisories. Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1, with upgrading being the only complete remediation.
Wiz has warned that 91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% have publicly exposed Node.js instances. Sysdig noted that the vulnerability is not in every Node.js service, but in services that decode attacker-influenced Brotli, such as Express 5 with default JSON parsing.
Federal Civilian Executive Branch (FCEB) agencies have been given a deadline of November 10, 2026, to apply the necessary fixes against the two flaws.
Related
