CISA Puts PolyShell and Node2Shell on Its Must-Patch List
CISA added Adobe Commerce's PolyShell and the Brotli Node2Shell bug to its exploited-vulnerabilities list, due Nov. 10, as ELLIO logged the first Node2Shell exploit traffic.
CISA added two critical bugs to its Known Exploited Vulnerabilities catalog on Oct. 27: PolyShell in Adobe Commerce and Magento, and the Brotli decoder flaw better known as Node2Shell or HTTP2Shell. Federal agencies have until Nov. 10 to fix both. The same day, sensor operators reported the first exploit traffic for the Brotli bug, The Hacker News reports, while PolyShell is already behind hundreds of breached online stores.
For defenders
The bugs: CVE-2026-48356 (PolyShell) is an unrestricted file upload in Adobe Commerce and Magento, CVSS 9.3, fixed in APSB26-73. Sansec ties it to most of the stores carrying a hidden CMS-block loader. CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder (versions 1.0.3 through 1.2.0), CVSS 4.0 score 9.2, and it reaches anything that decompresses attacker-supplied Brotli data: Node.js, PHP for Windows, .NET, Python packages, Bun, Envoy and more. Both are exploitation of a public-facing application, T1190 (Exploit Public-Facing Application). Public exploit code is reported for both, in 65 GitHub repositories for the Brotli bug.
What the exploit traffic looks like: ELLIO logged a 23 MB Brotli-encoded request body at 15:08 UTC on Oct. 26, built for exactly one binary, the official Node.js v24.22.0 x86-64 build, and aimed at launching a shell. In ELLIO’s own testing the chain crashed the process but got a shell in none of 50 tries, so it looks like a first attempt, not a polished weapon. The source IP has also hit PHP2Shell, GlobalProtect and FortiOS VPNs. Previdian separately logged one attempt from a US address. Sysdig notes that Express 5 apps using default JSON body parsing are in the exposed group, so reachability, not just version, decides your risk.
Fix: Node.js 22.23.4, 24.22.1 or 26.12.1 (no workaround, per the Node.js advisory); Brotli 1.0.10, 1.1.1 or 1.2.1; and vendor builds for PHP on Windows and .NET. Until you’re patched, ELLIO suggests dropping inbound requests with Content-Encoding: br at the edge. Background on the bug is in our first report and the researcher demo.
94.154.43[.]77fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4bWhat it means for you
Two very different things got the same “fix this now” label. If you run an online store on Magento or Adobe Commerce, PolyShell is how attackers have been planting code on hundreds of checkout pages. The Brotli bug lives in a compression library buried inside web servers and apps, so you may be running it without knowing. If someone else hosts your site, ask them whether both are patched.
Do this now
- Magento and Adobe Commerce owners: apply APSB26-73, then check for unknown admin accounts and odd code in CMS blocks.
- Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, and update Brotli wherever your apps bundle it.
- If you can’t patch today, block inbound
Content-Encoding: brrequests at your proxy or WAF. - Block the IP above and alert on unusually large compressed request bodies.
CVE at a glance
- CVSS
- 9.3 Critical (v3.1)
- EPSS
- 44.6% chance of exploitation in the next 30 days (higher than 98.7% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 27, 2026
- Public exploit
- Yes, reported in 1 GitHub repository
- CVSS
- 9.2 Critical (v4.0)
- EPSS
- 82.6% chance of exploitation in the next 30 days (higher than 99.6% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 27, 2026
- Public exploit
- Yes, reported in 73 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.