CISA Adds Google Brotli and Adobe Commerce Flaws to KEV Catalog
Critical vulnerabilities in Brotli and Adobe Commerce require immediate remediation by federal agencies.
1CISA Updates KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has officially added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog. These include flaws in the Google Brotli compression library and Adobe Commerce platforms. Federal agencies are now under a strict mandate to remediate these specific security gaps by the October 29, 2026 deadline.
2Google Brotli Memory Flaw
CVE-2026-111497, carrying a high CVSS score of 9.2, involves an unchecked return value vulnerability within the Google Brotli library. Remote, unauthenticated attackers can exploit this to corrupt decoder memory or execute arbitrary code. Because Brotli is a ubiquitous compression tool, this flaw impacts diverse environments including Node.js, PHP, Bun, and Microsoft .NET.
3Widespread Brotli Exposure
Security researchers at Wiz have highlighted the massive scale of the Brotli risk, noting that 91% of cloud environments contain vulnerable resources. Furthermore, 82% of these environments maintain publicly exposed Node.js instances. This widespread integration makes the library a high-value target for attackers looking to trigger crashes or gain unauthorized system access.
4Adobe Commerce File Upload
The second addition, CVE-2026-48356, is an unrestricted file upload vulnerability in Adobe Commerce and Magento with a 9.3 CVSS score. Dubbed PolyShell, this flaw allows attackers to execute arbitrary code using current user privileges. This effectively grants them the ability to take control of victim accounts or entire sessions through malicious file injections.
5Active PolyShell Exploitation
Sansec reports that attackers have already exploited CVE-2026-48356 to infect at least 953 online stores. By inserting a malicious loader into Magento CMS blocks, attackers can retrieve and execute external payloads. While the specific objectives of these campaigns remain unclear, the activity has been ongoing since at least July 2025, targeting e-commerce infrastructure.
6BOD 22-01 Compliance Requirements
Binding Operational Directive 22-01 mandates that Federal Civilian Executive Branch agencies address these identified vulnerabilities within the specified timeframe. This directive aims to reduce significant risks posed by actively exploited flaws. While the order specifically targets federal networks, security experts strongly advise private organizations to review their infrastructure and apply these patches immediately.
7Exploitation Patterns Observed
Researchers from Previdian and ELLIO have detected traffic carrying public exploits for the Brotli vulnerability, indicating potential large-scale malicious activity. Attackers are leveraging these flaws to cause system crashes or expose sensitive memory. The transition from proof-of-concept to active, weaponized traffic underscores the urgent need for comprehensive updates across all affected software dependencies.
8Strategic Security Implications
The inclusion of these flaws in the KEV catalog highlights the danger of vulnerabilities in widely used libraries like Brotli. When core components are compromised, the downstream impact affects multiple vendors and platforms simultaneously. Organizations must prioritize patching these specific CVEs to mitigate the risk of remote code execution and unauthorized data access.
Original article: Security Affairs — CISA Adds Google Brotli and Adobe Commerce Flaws to KEV Catalog