CISA Adds CVE-2026-111497 to KEV as PolyShell Targets Adobe Commerce Stores

En bref

• CVE-2026-111497 was added to CISA's KEV list on Tuesday after active exploitation was confirmed.
• PolyShell actors are linked to attacks on Adobe Commerce and Magento environments, with hundreds of stores in scope.
• Store breaches and observed exploit traffic show the campaign is ongoing.
• Administrators should inventory exposed commerce platforms, patch or mitigate quickly, and hunt for signs of compromise.

On Tuesday, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog, a move that confirms the flaw is being used in real attacks. The issue affects Adobe Commerce and Magento installations and is associated with the Brotli decoder. PolyShell attackers are the group linked to the exploitation activity, and the alert names Adobe, Magento, Google, and CISA among the vendors involved.

The operational impact is already visible: store breaches have occurred, and exploit traffic has been observed. Hundreds of stores are within the campaign's scope. Because these platforms power online storefronts, a compromise can disrupt sales, expose customer records, and force costly cleanup. The combination of active exploitation and a KEV listing raises the priority for defenders who may have delayed maintenance.

The KEV addition matters because it signals that federal remediation timelines may apply and that the vulnerability should not be treated as theoretical. For K-12 and government-adjacent organizations that run commerce sites, the risk is indirect but real: third-party storefronts, vendor portals, and public-facing web services can become entry points or reputational liabilities. Security teams should verify whether any Adobe Commerce or Magento instances are exposed and whether the Brotli decoder component is in use.

What to watch: new reports of store compromises, changes in exploit traffic patterns, and updated guidance from Adobe, Magento, Google, and CISA. Administrators should also monitor for follow-on activity such as unauthorized admin access or webshell placement, though the facts provided do not confirm those specifics. The immediate priority is to reduce exposure, preserve evidence where breaches are suspected, and track the KEV entry for deadlines.

À faire maintenant

1. Inventory every Adobe Commerce and Magento deployment, including externally reachable storefronts and staging systems, and confirm whether the Brotli decoder component is present.
2. Apply the latest vendor fixes or documented mitigations for CVE-2026-111497; if patching cannot happen immediately, restrict public access to affected services.
3. Hunt for exploit traffic and signs of PolyShell activity in web, application, and network logs, focusing on requests tied to the Brotli decoder and unusual admin behavior.
4. For any suspected store breach, isolate the instance, preserve logs and disk images, and begin incident response before rebuilding.
5. Rotate administrative credentials, API keys, and integration secrets for affected commerce platforms, and review third-party access.
6. Subscribe to CISA KEV updates and vendor advisories from Adobe, Magento, and Google, and assign an owner for remediation deadlines.
7. Add temporary WAF or network rules to block known malicious patterns while validating that legitimate storefront traffic is not disrupted.

Références CVE

• CVE-2026-111497

Source originale

The Hacker News