CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
CRITICAL · VULNERABILITYAdoberedteam/daily · 9 sources
- Severity
- Critical
- Highest CVSS
- 9.2
- Exploited
- Yes
- Sources
- 9
What happened
CISA added CVE-2026-111497 (Brotli unchecked return value, CVSS 9.2, aka Node2Shell) and CVE-2026-48356 (Adobe Commerce and Magento unrestricted file upload, CVSS 9.3, aka PolyShell) to KEV, with an FCEB deadline of October 29, 2026. Previdian and ELLIO observed Brotli exploitation attempts, including traffic carrying a public exploit. Wiz says 91% of cloud environments hold vulnerable resources. Sansec links PolyShell to at least 953 compromised stores, using a malicious loader inserted via a Magento CMS block, with activity since at least July 2025 and the final payload not recovered. Defenders should apply Adobe's July 14, 2026 updates and the Brotli fixes from Node.js, PHP, Bun and .NET, and review exposed stores for injected CMS blocks.
For security analysts · Written by AI from 9 sources · Wrong?
What to do
- Update Microsoft .net to the fixed version for your release line (fixes CVE-2026-111497): 8.0.33, 9.0.22 or 10.0.14.
- Update Google Brotli to the fixed version for your release line (fixes CVE-2026-111497): 1.0.10, 1.1.1 or 1.2.1.
- CISA lists CVE-2026-111497 as exploited and gives US federal agencies until 10 November 2026 to act (7 days left).
- Check whether you use Microsoft .net: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-111497CVSS 9.2ExploitedA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execu
- CVE-2026-114148CVSS 7.8Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
- CVE-2026-105482CVSS 7.4A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a
- CVE-2026-105483CVSS 7.4A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as
- CVE-2026-106069CVSS 7.4A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host fo
- CVE-2026-106072CVSS 6.7A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as
- CVE-2026-105481CVSS 6.5A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loo
- CVE-2026-106074CVSS 4.8A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or
- CVE-2026-106070CVSS 3.7A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compa
- CVE-2026-106071CVSS 3.6A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a
- CVE-2026-106073CVSS 3.3A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-re
- CVE-2026-48356Exploited
Full story timeline · 25 updates
- Thu 22 OctoberCVE-2026-111497 published, CVSS 9.2NVD
- Fri 23 OctoberNode.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers DoQualys Threat Research
- CVE-2026-105481 published, CVSS 6.5NVD
- CVE-2026-105482 published, CVSS 7.4NVD
- CVE-2026-105483 published, CVSS 7.4NVD
- CVE-2026-106069 published, CVSS 7.4NVD
- CVE-2026-106070 published, CVSS 3.7NVD
- CVE-2026-106071 published, CVSS 3.6NVD
- CVE-2026-106072 published, CVSS 6.7NVD
- CVE-2026-106073 published, CVSS 3.3NVD
- CVE-2026-106074 published, CVSS 4.8NVD
- Mon 26 OctoberPHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution FlawThe Hacker News
- Microsoft releases emergency .NET security fixes for Google Brotli bugThe Register (Security)
- eMudhra, Brotli, and the Long Tail of a Security FixSocket Blog
- Tue 27 OctoberCVE-2026-111497 added to CISA’s exploited listCISA KEV
- CVE-2026-48356 added to CISA’s exploited listCISA KEV
- Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)Tenable Blog
- Node.js Brotli Decoder Out-of-Bounds Write Threatens Remote Code Execution Across All Supported VersionsOrca Security Blog
- Adobe security advisory (AV26-697) – Update 1Canadian Centre for Cyber Security
- Wed 28 OctoberAdobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic EmergesThe Hacker News
- Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You OwnQualys Threat Research
- U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
- Adobe security advisory (AV26-1092)Canadian Centre for Cyber Security
- Thu 29 OctoberCVE-2026-114148 published, CVSS 7.8NVD
- USN-8958-1: .NET vulnerabilitiesUbuntu Security Notices
Who reported · 9 outlets
Qualys Threat ResearchThe Hacker NewsThe Register (Security)Socket BlogTenable BlogOrca Security BlogCanadian Centre for Cyber SecuritySecurity AffairsUbuntu Security Notices