CISA adds Adobe Commerce and Brotli bugs to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited V
What Happened
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday: a flaw in Adobe Commerce and Magento, and an overflow in Google’s Brotli decoder library tracked as CVE-2026-111497. The catalog update coincided with reports that a campaign dubbed “PolyShell” has breached hundreds of online stores running Adobe Commerce.
The combined picture is a supply-chain style attack unfolding on two fronts. On one side, attackers are exploiting the Commerce/Magento flaw to plant web shells and skimmer logic on merchant storefronts. On the other, malicious Brotli-compressed traffic is being observed in the wild, consistent with exploitation of the decoder overflow disclosed in the linked advisory.
Why It Matters
Adobe Commerce and Magento power a large share of mid-market and enterprise e-commerce. A compromised storefront does not just expose the merchant - it exposes every customer who enters payment details during the breach window. Hundreds of stores reportedly affected means the downstream victim pool could reach into the millions of card records.
The Brotli inclusion raises the stakes further. Because Brotli is a compression format embedded in browsers, CDNs, and reverse proxies, a memory-safety bug in a decoder can surface in places security teams rarely inventory. CISA’s KEV listing confirms exploitation, which removes any ambiguity about whether this is theoretical.
Technical Details
The PolyShell pattern follows familiar e-commerce intrusion mechanics: abuse of an unpatched Commerce endpoint to achieve remote code execution, followed by deployment of a persistent web shell and injection of client-side scripts that harvest checkout data. The shell provides durable access that survives routine patching of the original entry point.
CVE-2026-111497 is a buffer overflow in the Brotli decoder that leaks memory and can lead to remote code execution, per the Yazoul advisory. Exploit traffic in the wild has been observed using crafted Brotli streams, suggesting attackers are weaponizing the decoder path rather than relying solely on the Commerce flaw. Defenders should treat inbound Brotli-compressed payloads from untrusted sources as suspect.
Immediate Risk
Merchants on unpatched Commerce or Magento versions face active exploitation now, not in a future window. KEV listing obligates U.S. federal agencies to remediate on a compressed timeline, and private-sector risk is at least as high. Any organization decoding Brotli content at the edge - proxies, WAFs, load balancers - should verify library versions immediately.
Indicators to hunt for: unexpected PHP files in media or upload directories, obfuscated JavaScript in checkout templates, and anomalous outbound connections from web tiers. Check exposure for both CVE-2026-111497 and the Commerce flaw before end of day.
Security Insight
PolyShell is a reminder that e-commerce compromises rarely stay contained to the merchant. Historical parallels include the 2019 Magecart campaigns, where a single unpatched Magento extension seeded card-skimmers across thousands of unrelated storefronts. The distinguishing feature here is the Brotli angle: compression bugs are quietly becoming a shared attack surface across browsers and CDNs, much as image-parsing libraries became a decade ago. Security teams should start treating decoders like parsers - inventory them, fuzz them, and patch them with the same urgency as web-facing applications. The KEV additions are a lagging indicator; the real signal is that two unrelated decoder-level flaws are being exploited simultaneously, which suggests attackers are deliberately targeting the least-monitored layer of the stack.
Further Reading
Never miss a security update
Get real-time security alerts delivered to your preferred platform.
Related News
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involv
Google has released security updates to address 74 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-11645 (CVSS
Multiple official SAP npm packages were compromised in what is believed to be a TeamPCP supply-chain attack to steal credentials and authentication tokens from developers' systems. [...]
TeamPCP supply chain campaign resumed after a 26-day pause with three concurrent compromises (Checkmarx KICS, Bitwarden CLI, xinference PyPI). A new self-propagating npm worm, CanisterSprawl, has also been identified.