The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on 27 October added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: one affecting Adobe Commerce and Magento, and another in Google's Brotli compression decoder library, according to The Hacker News, which reported the additions on 28 October.
Operators running Adobe Commerce or Magento storefronts should treat this as an immediate patch-and-audit trigger. A KEV listing means CISA has seen credible evidence of exploitation in the wild, and under Binding Operational Directive 22-01, federal civilian agencies are required to remediate listed flaws by a stated deadline — a schedule that effectively functions as a market-wide yardstick for how urgently private operators should act.
The headline entry is CVE-2026-111497, carrying a CVSS base score of 9.2. CISA's listing describes it as an unchecked return value vulnerability in Adobe Commerce/Magento, with the agency's published entry currently offering only a partial account of the exploitation mechanism. A flaw rated at 9.2 sits in the critical band, and unchecked return value bugs in web applications commonly translate into attacker-controllable control flow or bypassed security checks — the kind of defect that lends itself to reliable, repeatable exploitation.
The second KEV entry concerns Google's Brotli decoder, a widely embedded library used for HTTP compression across web servers, CDNs, and application runtimes. No CVE identifier has yet been published against the Brotli entry in CISA's KEV catalog, so the flaw should be tracked through the listing itself until the agency assigns one. As general background, Brotli ships inside Chrome, as nginx modules, and within numerous language runtimes, which is part of why a flaw in it travels so far before anyone notices.
The Hacker News report ties the Adobe Commerce vulnerability to an intrusion campaign it names "PolyShell," and reported that the campaign had breached "hundreds of stores." That figure is the publication's attribution. Adobe has not confirmed the scale of the compromise, and the number should be treated as the source's claim pending vendor confirmation.
What operators should do now
- Inventory exposure. Identify every Adobe Commerce/Magento instance in the estate, including staging, legacy, and regional storefronts, and record running versions.
- Patch against CVE-2026-111497. Apply the vendor fix and confirm the deployment across all environments; do not assume a CDN or WAF in front of the storefront substitutes for the patch.
- Check Brotli dependencies. Audit web servers, reverse proxies, application frameworks, and container base images for vulnerable Brotli builds — including transitive dependencies pulled in through package managers.
- Hunt for prior compromise. Review access logs and admin account changes for indicators consistent with the reported exploitation activity; rotate credentials and API keys where exposure is suspected.
- Preserve evidence and escalate appropriately. If customer data is determined to have been accessed, engage incident response early and review applicable breach-notification obligations under local data protection law before making public statements.
The deeper problem: compression as attack surface
The Brotli entry deserves more attention than it usually gets. Compression libraries sit in an unusual position — they are near-universal, rarely surfaced in application inventories, and often updated only as a side effect of a broader dependency refresh. The fact that a decoder flaw reached KEV alongside a critical e-commerce bug illustrates how deep the patching chain runs: an operator can fix its storefront perfectly and still be exposed through an untouched transitive library two layers down.
For e-commerce teams, the practical takeaway is that dependency depth, not just application version, now defines patch posture.
據 The Hacker News 於 10 月 28 日報道，美國網絡安全和基礎設施安全局（CISA）已於 10 月 27 日將兩個遭實際利用的漏洞納入其已知遭利用漏洞（KEV）目錄：一個影響 Adobe Commerce 及 Magento，另一個則涉及 Google 的 Brotli 壓縮解碼器 library。
運行 Adobe Commerce 或 Magento 商店的營運者應將此事視為即時修補及審計的警號。列入 KEV 意味著 CISA 已掌握漏洞在野外遭利用的可信證據；根據《具有約束力的行動指令 22-01》（Binding Operational Directive 22-01），聯邦民事機構須在指定期限前修復已列明的漏洞——該時間表實際上成為整個市場衡量私人營運者行動急迫性的基準。
焦點條目為 CVE-2026-111497，CVSS 基準分數為 9.2。CISA 的記錄將其描述為 Adobe Commerce/Magento 中的未檢查回傳值（unchecked return value）漏洞，惟該機構目前公布的條目僅對利用機制作出部分說明。評分 9.2 的漏洞屬「嚴重」（critical）級別，而網絡應用程式中的未檢查回傳值缺陷，通常會轉化為攻擊者可控的控制流或繞過安全檢查——這類缺陷尤其容易被可靠、可重複地利用。
第二項 KEV 條目涉及 Google 的 Brotli 解碼器，這是一個廣泛嵌入的 library，用於各 web server、CDN 及應用程式 runtime 的 HTTP 壓縮。CISA 的 KEV 目錄中，Brotli 條目目前尚未獲指派 CVE 編號，在該機構正式指派前，應循該條目本身追蹤此漏洞的後續。作為一般背景，Brotli 隨附於 Chrome 內、以 nginx module 形式存在，亦嵌入眾多語言 runtime 之中，這正是其缺陷能在無人察覺下廣泛蔓延的原因之一。
The Hacker News 的報道將 Adobe Commerce 漏洞與其命名為「PolyShell」的入侵行動相連，並報稱該行動已攻破「數百家商店」。該數字屬該媒體的歸因。Adobe 尚未確認此次入侵的規模，在獲得廠商確認前，該數字應視為消息來源的說法。
營運者現階段應採取的措施
- 盤點暴露面。 識別系統架構中每一個 Adobe Commerce/Magento 實例，包括 staging、舊有及各地區商店，並記錄其運行版本。
- 針對 CVE-2026-111497 進行修補。 套用廠商修補程式，並確認所有環境均已部署；切勿假設商店前方的 CDN 或 WAF 可取代修補程式。
- 檢查 Brotli 依賴項。 審計 web server、反向 proxy、應用程式框架及 container base image 中存在漏洞的 Brotli build——包括經 package manager 引入的傳遞性依賴（transitive dependencies）。
- 搜尋先前入侵跡象。 檢視存取日誌及管理員帳戶變更，查找與已報道利用活動一致的指標；如懷疑已遭暴露，應輪換憑證及 API key。
- 保全證據並適當上報。 如確定客戶資料曾被存取，應及早介入事件應對（incident response），並在對外發表聲明前，檢視本地數據保護法例下的相關資料外洩通報責任。
深層問題：壓縮作為攻擊面
Brotli 條目應獲得比平時更多的關注。壓縮 library 處於一個特殊位置——它們幾乎無處不在，鮮少出現在應用程式的清單中，且往往只在更大規模的依賴更新時才順帶修補。一個解碼器漏洞與一個嚴重電子商務漏洞同時進入 KEV，正說明修補鏈條有多深：營運者即使完美修復了商店程式，仍可能透過下方兩層未經觸碰的傳遞性 library 而暴露於風險之中。
對電子商務團隊而言，實際結論是：決定修補姿態的，已不單是應用程式版本，更包括依賴項的深度。