CISA Adds Brotli & Adobe Flaws to KEV Catalog
CISA Adds Exploited Google Brotli and Adobe Commerce Flaws to KEV
CVE Identifiers
Full Report
Executive Summary
On October 27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two high-risk, actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The action mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these flaws by November 10, 2026. The first is CVE-2026-111497, a critical vulnerability in Google's Brotli compression library that can lead to remote code execution. The second, CVE-2026-48356, is an unrestricted file upload vulnerability in Adobe Commerce and Magento. The inclusion in the KEV catalog signifies that these vulnerabilities are being used in active attacks and pose a significant threat to organizations.
Vulnerability Details
CVE-2026-111497: Google Brotli "Node2Shell" Vulnerability
- Description: This is a high-severity (CVSS 4.0: 9.2 Critical) out-of-bounds write vulnerability in the Brotli decoder. An unauthenticated, remote attacker can send a specially crafted Brotli data stream that causes the decoder to incorrectly handle an invalid block switch. This leads to an overflow of an internal buffer, which can be leveraged to cause a process crash (denial of service), disclose sensitive memory contents, or achieve arbitrary code execution.
- Alias: The flaw has been referred to as "Node2Shell" due to its significant impact on the Node.js ecosystem, which uses Brotli as a dependency.
- Impact: The vulnerability's reach is extensive, as Brotli is a widely used compression library found in numerous applications and services beyond Node.js.
CVE-2026-48356: Adobe Commerce/Magento File Upload Vulnerability
- Description: This vulnerability is categorized as an "Unrestricted Upload of File with Dangerous Type." It allows an attacker to upload a malicious file (such as a webshell) to a server running Adobe Commerce or Magento. Once uploaded, the attacker can execute the file to gain control over the server.
- Impact: This type of flaw is a common and effective vector for gaining initial access, often used to deploy payment card skimmers, ransomware, or to pivot deeper into a network.
Affected Systems
- CVE-2026-111497: Any application or system that uses a vulnerable version of the Google Brotli compression library. This prominently includes, but is not limited to, many versions of Node.js.
- CVE-2026-48356: Vulnerable versions of Adobe Commerce and Magento Open Source.
Exploitation Status
CISA has confirmed that both vulnerabilities are being actively exploited in the wild. The agency noted that live exploit traffic is already targeting vulnerable Node.js servers for the Node2Shell flaw. The specific threat actors or campaigns exploiting these flaws were not detailed in the alert, but the active exploitation status elevates the urgency for all organizations to patch.
Impact Assessment
The Node2Shell vulnerability (CVE-2026-111497) poses a widespread risk due to its presence in a fundamental library. A single flaw in a dependency like Brotli can create vulnerabilities in countless upstream applications, making it difficult for organizations to track their full exposure. Successful exploitation can lead to a full system compromise.
The Adobe Commerce flaw (CVE-2026-48356) presents a direct threat to e-commerce operations. Attackers can take over servers, steal sensitive customer payment information, and disrupt business operations, leading to significant financial and reputational damage.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
log_sourcefile_path/media/, /pub/) for recently uploaded files with suspicious extensions like .php, .phtml, or .aspx that are not part of the legitimate application.url_patternDetection Methods
- Vulnerability Scanning: Use authenticated and unauthenticated vulnerability scanners to identify systems running vulnerable versions of Node.js, Adobe Commerce, Magento, or any other software known to use the Brotli library.
- Software Bill of Materials (SBOM): Organizations with a mature application security program can use an SBOM to quickly identify all applications that include the vulnerable Brotli library as a dependency.
- File Integrity Monitoring: Monitor critical application directories on Adobe Commerce/Magento servers for any unauthorized file creation or modification, which could indicate a webshell upload.
Remediation Steps
- Patch Immediately: Per the CISA directive, all organizations, especially federal agencies, should apply the relevant security patches for CVE-2026-111497 and CVE-2026-48356 immediately. The deadline for FCEB agencies is November 10, 2026.
- Prioritization: Prioritize patching on internet-facing systems, as these are the most likely targets for exploitation.
- Review and Harden: After patching the Adobe flaw, review web server directories for any suspicious files that may have been uploaded prior to patching and remove them. Ensure file upload functionality is properly configured to only allow safe file types.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Applying vendor-supplied patches is the most effective way to remediate these vulnerabilities.
Mapped D3FEND Techniques:
Restrict Web-Based Content
For the Adobe flaw, configure the web server to only allow uploads of non-executable file types to prevent webshell deployment.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The primary and most critical countermeasure for both CVE-2026-111497 (Node2Shell) and CVE-2026-48356 is immediate software updating. Since CISA has confirmed active exploitation, organizations must treat this as a top priority. For Node2Shell, this involves identifying all applications using the vulnerable Brotli library—primarily by updating Node.js to a patched version—and applying the fix. For the Adobe flaw, administrators must apply the security patch provided by Adobe for their Commerce or Magento installations. A robust patch management program that can quickly identify and deploy these critical updates across all affected assets is essential. The CISA deadline of November 10th for federal agencies should be adopted as a benchmark for all organizations to complete remediation.
As a detective and preventative control for CVE-2026-48356, File Analysis is highly effective. This can be implemented through a Web Application Firewall (WAF) or an endpoint security agent on the web server. The system should be configured to inspect all file uploads to the Adobe Commerce/Magento platform. Rules should be set to block any files with executable extensions (e.g., .php, .phtml, .sh, .exe). Furthermore, the content of allowed files (e.g., images) should be analyzed to detect embedded scripts or malformed headers that could be used to bypass filters. This technique directly counters the 'Unrestricted Upload of File with Dangerous Type' vulnerability by creating a control gate that validates every file before it is written to the server's disk, preventing webshells from being planted.
Timeline of Events
CISA adds CVE-2026-111497 and CVE-2026-48356 to the KEV catalog.
Deadline for U.S. federal agencies to apply patches for the two vulnerabilities.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.