Primary sources: cisa.gov, cisa.gov, cve.org, nvd.nist.gov

The U.S. Cybersecurity and Infrastructure Security Agency on Oct. 27 added two vulnerabilities — CVE-2026-48356 in Adobe Commerce and Magento, and CVE-2026-111497 in Google's Brotli decoder library — to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation^2,1.

Tenable and SecurityOnline.info said the catalog entries give Federal Civilian Executive Branch agencies until Nov. 10, 2026, to apply vendor mitigations^3,4. CISA cited Binding Operational Directive 26-04 and said it encourages all organizations to prioritize KEV items². SecurityOnline.info said CISA has not identified attackers and lists ransomware use as unknown for both flaws⁴.

CVE-2026-48356 is an unrestricted file-upload issue that Adobe scored 9.3 and said can lead to code execution in the current user's context^1,4. Adobe's CVE record, published July 14, 2026, states exploitation requires user interaction, such as visiting a crafted URL or a compromised page, and lists fixed 2026-jul builds for Commerce, Magento Open Source, Commerce B2B and Commerce Events⁴.

Days before the KEV add, Sansec said attackers used CVE-2026-48356, also called PolyShell, to breach hundreds of e-commerce stores by injecting a malicious loader through a Magento CMS block, The Hacker News reported¹. Sansec said no next-stage malware had been recovered, so campaign goals were still unclear, and assessed the activity as ongoing since at least July 2025¹. SecurityOnline.info noted that Adobe's July bulletin APSB26-73 already shipped the Magento fix⁴.

CVE-2026-111497, also called Broccoli2Shell, HTTP2Shell, Node2Shell or Brotli2Shell, is an unchecked return value and out-of-bounds write in the Brotli decoder that Google scored 9.2^1,3. Tenable and SecurityOnline.info said affected Brotli versions include 1.0.3 through 1.2.0, with fixes in 1.0.10, 1.1.1 or 1.2.1, and that products bundling the library need their own updates^3,4.

Tenable said Google committed an upstream fix on Feb. 27 and that Node.js disclosed the issue on Oct. 21, the same day Google released fixed Brotli versions³. Rapid7, cited by The Hacker News, said an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, with exposure depending on whether attacker-controlled compressed data reaches the decoder¹. Sysdig said the bug is not in every Node.js service, but in services that decode attacker-influenced Brotli, including some Express 5 setups with default JSON parsing¹.

For in-the-wild Brotli attempts, Previdian said its honeypots recorded one exploitation attempt from a U.S. IP as of Oct. 27¹. ELLIO said its sensors saw exploit traffic from a Netherlands IP matching public Node2Shell tooling for Node.js v24.22.0¹. Tenable said it has not independently confirmed ELLIO's report³. The Hacker News said it is not known whether those Brotli attempts are broad¹.

Node.js fixed the issue in versions 22.23.4, 24.22.1 and 26.12.1, Akamai said, with no workaround other than upgrading¹. PHP, Bun, Envoy Proxy, Istio,.NET and other vendors have shipped patches or assessments^1,3. Google-owned Wiz said 91 percent of cloud environments it measured had resources vulnerable to CVE-2026-111497 and 82 percent had publicly exposed Node.js instances¹. CISA has not named attackers behind either listing⁴.