The Cybersecurity and Infrastructure Security Agency (CISA) has recently flagged two critical vulnerabilities affecting Adobe Commerce, Magento, and Google’s Brotli decoder, highlighting active exploitation. These vulnerabilities have been incorporated into CISA’s Known Exploited Vulnerabilities catalog, emphasizing the pressing threat they pose.
Details of the Vulnerabilities
The first vulnerability, designated as CVE-2026-111497, presents a significant risk due to an unchecked return value in Google’s Brotli. This flaw enables remote attackers to manipulate adjacent memory states, potentially leading to denial-of-service, memory disclosure, or arbitrary code execution through crafted Brotli-compressed data streams. This vulnerability carries a severity score of 9.2.
Another critical flaw, CVE-2026-48356, impacts Adobe Commerce and Magento. This vulnerability allows for the unrestricted upload of dangerous file types, which can result in arbitrary code execution. Attackers exploiting this flaw can gain elevated access or control over victim accounts, rendering it even more severe with a CVSS score of 9.3.
Active Exploitation and Impact
Security firm Sansec recently observed attackers leveraging CVE-2026-48356, also known as PolyShell, to compromise hundreds of e-commerce platforms. These attacks involve injecting a malicious loader through a Magento CMS block, although the full extent of the malware’s objectives remains uncertain. This campaign has reportedly been active since July 2025.
Additionally, telemetry from Previdian indicates an attempt to exploit CVE-2026-111497 using a U.S.-based IP address. However, the broader scope of these attempts is yet to be determined. Rapid7 has warned that Brotli data decompression via node:zlib could allow attackers to corrupt process memory, potentially leading to crashes, data leaks, or remote code execution.
Industry Response and Recommendations
In light of these vulnerabilities, the industry has responded swiftly. Node.js has released updates in versions 22.23.4, 24.22.1, and 26.12.1 to address these issues. Other affected platforms, including PHP, Bun, Envoy Proxy, and others, have also rolled out fixes. Organizations are advised to apply these updates promptly to mitigate the risks.
According to Wiz, a significant percentage of cloud environments have resources vulnerable to CVE-2026-111497, highlighting the widespread nature of the threat. Sysdig clarifies that while not all Node.js services are at risk, those processing attacker-controlled Brotli data are vulnerable. The urgency of patching depends on the potential reachability and impact of these services.
Federal agencies have been mandated to implement the necessary patches by November 10, 2026, to safeguard against these vulnerabilities. This directive underscores the critical nature of these flaws and the need for immediate action.
As the cybersecurity landscape evolves, staying informed and proactive is crucial for minimizing risks associated with such vulnerabilities.
