As reported by SecurityAffairs, CISA has elevated two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: a Google Brotli unchecked-return-value flaw (CVE-2026-111497, CVSS 9.2) and an Adobe Commerce/Magento unrestricted file upload (CVE-2026-48356, CVSS 9.3). Both are being abused in the wild, but they sit at opposite ends of the exploitability spectrum — and that contrast is what makes this KEV update strategically important.

Security Impact: As reported by SecurityAffairs, CISA has elevated two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: a Google Brotli unchecked-return-value flaw (CVE-2026-111497, CVSS 9.2) and an Adobe Commerce/Magento unrestricted file upload (CVE-2026-48356, CVSS 9.3).

Why Brotli Is the Bigger Story

Brotli is not a product — it is infrastructure. The library ships inside Node.js, PHP, Bun, .NET, every major browser, countless CDN pipelines, and the transitive dependency trees of tens of thousands of applications. A memory-corruption primitive in the decoder therefore has a blast radius that conventional patch cadence cannot easily contain. Wiz's figure that 91% of cloud environments contain vulnerable Brotli-linked resources is not hyperbole; it reflects the reality that compression is assumed to be benign and rarely appears as a first-class risk item in asset inventories.

The exploitation path described — attacker-controlled Brotli streams triggering memory corruption during decompression — means the threat surface is effectively any endpoint that accepts, proxies, or processes compressed web content. That includes ingest pipelines, webhook receivers, reverse proxies with brotli decoding, and serverless functions that pass through Content-Encoding: br. ELLIO's observation of public exploit traffic and Previdian's telemetry confirm weaponization has moved past proof-of-concept.

Magento Campaign: Familiar Pattern, Broader Reach

CVE-2026-48356 ("PolyShell") follows the well-trodden e-commerce skimming playbook: an unrestricted upload abused to inject a loader into a Magento CMS block, which then fetches a remote payload. Sansec's count of 953 infected stores indicates a successful, likely automated campaign. The payload has not been recovered, but historical analogues — Magecart, Rez3R, and the long tail of Magecart-style loaders — point to credit-card interception and admin-session theft as the most probable end goals.

What is notable is that unrestricted file upload flaws in Magento are not novel failure classes. The fact that this KEV-worthy campaign succeeded against nearly a thousand stores suggests that long-tail Adobe Commerce deployments continue to lag on patching, hardening, and WAF coverage for admin-controlled upload paths.

Strategic Implications

Magento Campaign: Familiar Pattern, Broader Reach
Foundational libraries deserve CVE-class attention. Brotli's status as ubiquitous, trusted, and assumed-safe is exactly what makes it attractive to adversaries. Defenders need SBOM visibility that surfaces transitive compression dependencies, not just direct imports.
E-commerce long tail remains a soft target. Mid-market Magento stores on shared hosting, often managed by overstretched agencies, are consistently the highest-value, lowest-effort targets in the retail sector.
KEV listing is not a reminder — it is a clock. CISA's BOD-22-01 deadlines apply to FCEB agencies, but the practical effect on commercial defenders is to compress remediation windows from "next sprint" to "this week."

Shield53 Recommendations

  • Brotli / CVE-2026-111497: Inventory every runtime that links libbrotli or wraps a brotli decoder — Node.js, PHP, Bun, .NET, edge workers, reverse proxies. Patch to vendor-advised versions immediately. For services that cannot patch today, disable Brotli Content-Encoding negotiation at the edge until updates are deployed.
  • Dependency hygiene: Pull SBOMs from your build pipeline (CycloneDX or SPDX) and grep for brotli, libbrotlidec, and zlib-brotli across containers and Lambda layers. Patch the runtime image, then redeploy — do not rely on transitive resolution alone.
  • Magento / CVE-2026-48356: Apply Adobe's patched Commerce release, restrict admin-panel file upload paths via WAF rules (deny executable extensions, enforce MIME validation server-side), and audit CMS blocks for unauthorized loader code. Sansec's published IOCs should be incorporated into EDR/SIEM detection rules.
  • Detection: Hunt for outbound HTTPS from Magento admin hosts to unfamiliar domains, unexpected eval-style loader patterns in static_blocks, and anomalous Brotli decode errors in application logs — these often precede confirmed compromise.
  • Posture: Add foundational compression and parsing libraries to your critical dependency watchlist. Treat them as crown-jewel supply-chain components, not background utilities.

The lesson from this KEV update is not that two new CVEs exist — it is that defenders still struggle to inventory the components their software actually depends on. Until SBOMs are routine and foundational libraries are treated as first-class risks, KEV will keep adding entries faster than enterprises can patch them.