CISA Adds Adobe Commerce PolyShell and the Brotli Flaw to the KEV Catalog: Both Due November 10

CISA KEV catalog additions October 27, 2026; The Hacker News report October 28, 2026

CISA Adds Adobe Commerce PolyShell and the Brotli Flaw to the KEV Catalog: Both Due November 10

Threats

CISA NIST and the NIST Cybersecurity Framework (CSF 2.0)MITRE ATT&CK

CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog on October 27 and set a remediation due date of November 10, 2026 for federal civilian agencies. The first, CVE-2026-48356 (CVSS 9.3), is an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento, also called PolyShell; Sansec reported attackers using it to breach hundreds of e-commerce stores and inject a malicious loader through a Magento CMS block, in a campaign The Hacker News describes as ongoing since at least July 2025, while public research referenced in the CVE record dates PolyShell attacks to March 2026. The second, CVE-2026-111497 (CVSS 9.2), is the Brotli decoder flaw covered in yesterday's .NET story, now listed under Google Brotli with exploit traffic recorded by ELLIO sensors on October 26 and 27; Wiz warned that 91 percent of cloud environments have resources vulnerable to it and 82 percent have publicly exposed Node.js instances. CISA lists known ransomware campaign use as unknown for both flaws. Fixed versions include the Adobe builds in bulletin APSB26-73, Node.js 22.23.4, 24.22.1, and 26.12.1, Brotli 1.0.10, 1.1.1, and 1.2.1, and the .NET runtimes 8.0.33, 9.0.22, and 10.0.14.

Executives

Two different estates carry the same November 10 clock: your storefront platform and a compression library buried inside web runtimes. The Adobe flaw is already breaching stores at scale, and the Brotli flaw is now confirmed exploited, not theoretical. Ask for a single dated answer covering both: which systems run the affected builds, and which have been checked for what attackers may already have left behind.

CIO / CISO

Patch to the APSB26-73 builds and to Node.js 22.23.4, 24.22.1, or 26.12.1, then hunt before you close the ticket: uploaded files and injected scripts in the Magento upload paths and CMS blocks, new admin users, and Node.js services that decompress attacker-controlled Brotli data through request bodies or fetched responses. Work to November 10 even though the date binds federal agencies, because KEV listing means CISA holds evidence of active exploitation for both flaws.

Engineers

For Magento and Adobe Commerce, apply the July builds named in APSB26-73, compare any custom web server configuration against Magento's sample rule that denies web access to the media upload directory, and search pub/media/custom_options for files that are not images. For Brotli, updating npm packages is not enough: the flaw is in the runtime and the library, so rebuild containers and bundled binaries on a fixed Node.js or Brotli release and restart the services.

Everyone (non-IT)

If you shop at a small online store this month, nothing here asks you to act. If you run one on Magento, the patch and the check for planted files are both yours to do this week, and the second matters as much as the first.