3 hours ago
7
.jpg)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerabilities are listed below -
- CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in Google Brotli that could allow a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial-of-service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
- CVE-2026-48356 (CVSS score: 9.3) - An unrestricted upload of a file with dangerous type vulnerability in Adobe Commerce and Magento that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
The development comes days after Sansec said it observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.
The loader is designed to fetch and execute an attacker-controlled payload, although no next-stage malware has been recovered to date, making it challenging to determine what the exact goals of the campaign are. The activity is assessed to be ongoing since at least July 2025.
As for CVE-2026-111497 (aka Broccoli2Shell, HTTP2Shell, and Node2Shell), telemetry data from threat intelligence firm Previdian shows that one exploitation attempt has been recorded against its honeypot sensors from a U.S.-based IP address as of October 27, 2026. It's currently not known if these efforts are broad in scope.
"An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory," Rapid7 said. "According to Node.js, this corruption can lead to a process crash, disclosure of sensitive process memory, or remote code execution. Exposure therefore depends on whether an application passes attacker-controlled compressed data to the affected decoder."
ELLIO also reported on Monday that its sensors "have recorded CVE-2026-111497 exploit traffic in the wild, carrying the public exploit that we confirmed gets a shell on vulnerable builds." The activity originates from "94.154.43[.]7," an IP address geolocated to the Netherlands that has also engaged in exploitation efforts targeting PHP2Shell, two critical flaws in PHP that could result in unauthenticated remote code execution.
"The attacker's payload is a genuine, correctly-structured Node2Shell exploitation attempt for node v24.22.0 – the Brotli stream, staged displacement, pivot pair, and delivery are all correct and identical to the public tooling," ELLIO said. "This is indicative of the RCE being adopted by an operator focused on mass exploitation."
The fact that Brotli is a widely distributed open-source library and adopted by numerous projects has provoked an emergency response, prompting various vendors to release patches or assess if their products are affected by the flaw.
This includes PHP, which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem. Links to some of the advisories are below -
- Amazon Linux
- Bun
- Cisco
- Cloudflare
- CloudLinux
- Envoy Proxy
- F5
- Fortinet
- Imperva
- Istio
- Microsoft Azure
- Microsoft .NET
- Node.js
- Palo Alto Networks
- PHP
- Qualys
- Red Hat
- Safe Security
- Strapi
- Tanium
- Tenable
- Ubuntu
- Upwind
"Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said. "The Node.js advisory does not offer a workaround, so upgrading is the only complete remediation. Organizations running a discontinued release line should move to a supported release line."
Google-owned Wiz has warned that "91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% of cloud environments have publicly exposed Node.js instances."
"Node2Shell is not a bug in every Node.js service, but a bug in services that decode attacker-influenced Brotli," Sysdig said. "Express 5 with default JSON parsing puts a large number of instances of them in that group. The demonstrated impact thus far is crashes at scale and code execution in a narrow configuration, so patch order should follow reachability."
Federal Civilian Executive Branch (FCEB) agencies have time until November 10, 2026, to apply the necessary fixes against the two flaws.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
.jpeg)
