CISA Adds Adobe Commerce, Brotli Flaws to Exploited Catalog Amid Store Breaches

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities, one impacting Adobe Commerce and Magento, and another affecting Google’s Brotli decoder library, to its authoritative Known Exploited Vulnerabilities (KEV) catalog. The inclusion, announced on Tuesday, October 27, 2026, cites clear evidence of active exploitation in the wild.

One of the flaws, tracked as CVE-2026-111497, is an unchecked return value vulnerability in Adobe Commerce and Magento with a critical CVSS score of 9.2. While the second vulnerability, affecting Google’s Brotli decoder library, was not immediately identified by a specific CVE in the advisory, CISA confirmed its active exploitation.

The CISA warning comes amid reports of widespread ‘PolyShell Attacks’ that have already leveraged such vulnerabilities to breach hundreds of online stores. These attacks target the e-commerce platforms, potentially leading to data theft and significant disruption for affected merchants.

Organisations running Adobe Commerce and Magento installations, as well as those using Google’s Brotli decoder library, are urged to review CISA’s advisory and implement available patches or mitigations immediately to prevent compromise. The high CVSS score for the Adobe Commerce flaw indicates a severe risk, allowing attackers significant control without requiring complex attack chains.

The KEV catalog serves as a critical resource for federal agencies and private sector organisations, highlighting vulnerabilities that are actively being used by threat actors and requiring urgent remediation.