CISA adds CVE-2026-48356 and CVE-2026-111497 to KEV catalog Amid PolyShell attacks

CISA added CVE-2026-48356 and CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on Oct. 27, 2026, citing evidence of active exploitation, an update to the KEV listings as the PolyShell campaign tied to the Adobe Commerce flaw compromises hundreds of online stores.

The unrestricted file-upload vulnerability tracked as CVE-2026-48356 affects Adobe Commerce and Magento with a CVSS score of 9.3, and it can result in arbitrary code execution. The Brotli decoder library from Google is affected by CVE-2026-111497, which carries a CVSS score of 9.2. The flaw can corrupt memory, expose data, or allow remote code execution. CISA KEV records list potential code execution for both flaws, and the Brotli entry warns the library can show up in other products.

Sansec counted at least 953 infected stores in the PolyShell campaign, which ties the CVE-2026-48356 file-upload flaw to hundreds of compromised online stores. On March 17, 2026, Sansec found CVE-2026-48356 and gave it the name PolyShell, and it disclosed a large automated attack wave on March 30, 2026. Sansec tied PolyShell to a content-block loader campaign on Oct. 24, 2026. The activity has been ongoing since at least July 2025 and remains ongoing.

Sansec saw attackers use a Magento CMS block to inject a malicious loader that retrieves and runs an attacker-controlled payload. Researchers have not recovered the next-stage payload from the PolyShell campaign. Sansec reported exploitation attempts dating to March 2026 and observed more than 50 IP addresses scanning for the CVE-2026-48356 flaw.

Both flaws must be remediated by Federal Civilian Executive Branch agencies by Nov. 10, 2026. Under Binding Operational Directive rules, the catalog placement requires federal agencies to fix the flaws by the due date. By Dec. 7, 2026, FedRAMP requires mandatory adoption of vulnerability detection and response rules.

According to Security Affairs, CISA ordered federal agencies to fix the flaws by Oct. 29, 2026. The outlet said security experts urge private organizations to review the catalog and prioritize the vulnerabilities in their infrastructure.

Wiz said CVE-2026-111497 touches resources in 91% of cloud environments, while publicly exposed Node.js instances appear in 82%. Previdian logged one exploitation attempt against CVE-2026-111497 from a U.S.-based IP address by Oct. 27, 2026. ELLIO saw CVE-2026-111497 exploit traffic from a Netherlands IP address carrying a public exploit that opens a shell on vulnerable Node.js builds. ELLIO said, “This is indicative of the RCE being adopted by an operator focused on mass exploitation.”

Node.js issued fixes for CVE-2026-111497 in versions 22.23.4, 24.22.1, and 26.12.1, and Akamai said upgrading is the only complete remediation, with no workaround offered. Brotli fixes can be found in versions 1.0.10, 1.1.1, or 1.2.1. Vendors including PHP, Bun, and Microsoft .NET have released or are assessing updates.

Vendors including Amazon Linux, Bun, Cisco, Cloudflare, CloudLinux, Envoy Proxy, F5, Fortinet, Imperva, and Istio have released or are assessing advisories covering the Brotli flaw. Advisories also cover Microsoft Azure, Microsoft .NET, Node.js, Palo Alto Networks, PHP, Qualys, Red Hat, Safe Security, Strapi, Tanium, Tenable, Ubuntu, and Upwind.

Red Hat rates the Brotli issue as Important and notes that platform protections complicate reliable code execution. Microsoft says ASP.NET Core and HttpClient skip automatic Brotli decompression by default, meaning exposure hinges on enabled decompression or explicit API use. Sysdig said Express 5 with default JSON parsing puts instances in the vulnerable group, with impact that includes crashes at scale and code execution in narrow setups.

CISA has not identified the attackers, and ransomware use remains listed as unknown for both flaws. For CVE-2026-48356, CISA has not released indicators of compromise, while Sansec has published its own indicators.

Adobe published security bulletin APSB26-73 on July 14, 2026 to fix CVE-2026-48356, and the bulletin said Adobe did not know of exploitation at that time. Adobe’s isolated patches cover only the newest patch level in each line, so stores on older patch levels need to move up to that level first. Cloud versions of Adobe Commerce get the fix through the latest cloud-patches update, whereas Magento Open Source isolated patches are available only for 2.4.6 and later. Store operators should confirm they installed the July fix and look for files planted before patching, including upload directories and CMS content.