# CISA KEV adds Google Brotli (CVE-2026-111497, Node2Shell) and Adobe Commerce/Magento (CVE-2026-48356, PolyShell) flaws

> CISA added two actively exploited flaws to its KEV catalog: an unchecked-return-value / out-of-bounds write bug in the Google Brotli decoder (CVE-2026-111497, 'Node2Shell', CVSS 9.2) and an unrestricted file upload bug in Adobe Commerce and Magento (CVE-2026-48356, 'PolyShell', CVSS 9.3). Sansec observed a PolyShell-linked campaign infecting at least 953 online stores, ongoing since at least July 2025.

- **Published:** 2026-10-28T11:12:24Z
- **Last reviewed:** 2026-10-28T11:12:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4637
- **ID:** TL-2026-4637
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-111497, CVE-2026-48356

## Description

CVE-2026-111497 (Node2Shell, also called HTTP2Shell) is a memory-safety flaw in the Brotli decoder (c/dec/decode.c). Per Sysdig, the decoder confuses incomplete input with invalid input and keeps processing a malformed stream: a crafted stream declares one data block type and then requests a block-type switch, the unpatched decoder ignores the resulting error and writes past the end of its buffer (CWE-787). CISA describes the impact as allowing a remote, unauthenticated attacker to corrupt decoder memory, expose sensitive information, cause a denial of service, or potentially execute arbitrary code. Exposure requires the application to decompress attacker-influenced Brotli data: Express 5 / body-parser 2.x inflate 'Content-Encoding: br' request bodies, fetch() auto-decompresses Brotli responses from compromised servers or webhooks, and code can call node:zlib Brotli functions directly. Affected: Node.js below 26.12.1, 24.22.1 and 22.23.4 (EOL lines such as 25.x, 23.x and 20.x have no fix), Bun 1.4.3 and earlier (fixed 1.4.4), bundled Brotli 1.0.3-1.0.9, 1.1.0 and 1.2.0 (fixed 1.0.10, 1.1.1, 1.2.1), PHP and Microsoft .NET (fix covers .NET 8, 9, 10; .NET 6 remains exposed). The npm 'brotli' package is not affected. The fix was committed to Brotli in February 2026 and Node.js shipped patches on 2026-10-21; a public GitHub PoC appeared about five hours later. On 2026-10-22 Imperva reproduced code execution on Node.js 24.22.0 (Linux arm64) via fetch() and Express 5 body-parser, but only with repeated attempts; reliable blind RCE against ASLR has not been shown publicly, so DoS and memory disclosure are the most dependable impacts. Per the CISA alert (2026-10-26) exploitation is observed: Previdian recorded an exploitation attempt by 2026-10-27 and ELLIO detected public exploit traffic. Wiz reports 91% of cloud environments contain Brotli-vulnerable resources and 82% have publicly exposed Node.js instances.

CVE-2026-48356 (PolyShell) is an unrestricted file upload flaw in the Magento Open Source / Adobe Commerce REST API. Unauthenticated requests to POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId can carry a file-type custom option with an embedded file_info object (base64 data, MIME type, filename); the file is written under pub/media/custom_options/quote/. Sansec found no check that the option ID belongs to the product, no extension blocking (.php, .phtml, .phar accepted), and an image-header check (getimagesizefromstring) that is bypassed with polyglot GIF89a/PNG files carrying PHP. Depending on web server configuration the result is RCE or stored-XSS account takeover. Sansec reports all versions up to 2.4.8 vulnerable (The Hacker News: up to 2.4.9-alpha2); the fix first appeared in 2.4.9 pre-releases, Adobe released 2.4.9 on 2026-05-12 and a backport via APSB26-73 on 2026-07-14. Exploitation began 2026-03-16, mass scanning from at least 50 IPs started 2026-03-19, and a mass wave on 2026-03-30 compromised 471 stores in one hour. Observed payloads include password-protected eval(base64_decode()) webshells (index.php, json-shell.php, bypass.phtml, c.php, rce.php, static.php, mikhail.html and Unicode-escaped filenames) and the 'accesson.php' backdoor scattered across writable directories, which answers with beacon value 8194460 (409723*20). Two-stage obfuscated JavaScript loaders are injected into Magento CMS blocks/pages, fetch remote payloads from lanhd6549tdhse.top, jslibrary.net and canevaslab.com, persist via a localStorage key, and collect visitor fingerprinting data. Sansec's October 2026 report tied a campaign against at least 953 stores (five domains) to this CMS-block loader technique, active since at least July 2025. Some PolyShell attacks deliver a WebRTC-based payment-card skimmer (per press reports of Sansec research). The hunt skeleton and Security Affairs map CVE-2026-48356 to PolyShell; other sources reviewed do not state the CVE ID explicitly. CISA BOD 22-01 remediation deadline for both is 2026-10-29. No threat actor attribution is stated in any source.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1059 Command and Scripting Interpreter
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1027 Obfuscated Files or Information
- T1036.008 Masquerading: Masquerade File Type
- T1140 Deobfuscate/Decode Files or Information
- T1071.001 Application Layer Protocol: Web Protocols
- T1583.001 Acquire Infrastructure: Domains
- T1608.001 Stage Capabilities: Upload Malware

## Sources

- [U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/201922/security/u-s-cisa-adds-google-brotli-and-adobe-commerce-and-magento-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [Sansec: PolyShell - unrestricted file upload in Magento and Adobe Commerce](https://sansec.io/research/magento-polyshell)
- [Sansec: Mass PolyShell attack wave hits 471 stores in one hour](https://sansec.io/research/polyshell-mass-attack-wave)
- [Sysdig: Node2Shell (CVE-2026-111497) - detecting the Node.js Brotli RCE](https://www.sysdig.com/blog/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce)
- [Aikido: Node2Shell Node.js Brotli RCE CVE-2026-111497](https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497)
- [HeroDevs: CVE-2026-111497 Node2Shell Node.js Brotli RCE](https://www.herodevs.com/blog-posts/cve-2026-111497-node2shell-node-js-brotli-rce)
- [The Hacker News: Magento PolyShell flaw enables unauthenticated file upload](https://thehackernews.com/2026/03/magento-polyshell-flaw-enables.html)
- [BleepingComputer: PolyShell attacks target 56% of all vulnerable Magento stores](https://www.bleepingcomputer.com/news/security/polyshell-attacks-target-56-percent-of-all-vulnerable-magento-stores/)
- [Security Affairs: PolyShell flaw exposes Magento and Adobe Commerce to file upload attacks](https://securityaffairs.com/189744/security/polyshell-flaw-exposes-magento-and-adobe-commerce-to-file-upload-attacks.html)
- [HKCERT: Node.js Multiple Vulnerabilities](https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20261022)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4637