CERT24Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic EmergesLoading data…
CERT24Threat Observatory
Period

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

CISA added two vulnerabilities affecting Adobe Commerce, Magento, and Google’s Brotli decoder library to its KEV catalog, citing evidence of active exploitation. Attackers have reportedly used CVE-2026-48356, known as PolyShell, to breach hundreds of e-commerce stores and inject a malicious loader through a Magento CMS block. Exploitation attempts involving CVE-2026-111497 have also been recorded, including exploit traffic observed in the wild.

← Back to intelligence

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

CISA added two vulnerabilities affecting Adobe Commerce, Magento, and Google’s Brotli decoder library to its KEV catalog, citing evidence of active exploitation. Attackers have reportedly used CVE-2026-48356, known as PolyShell, to breach hundreds of e-commerce stores and inject a malicious loader through a Magento CMS block. Exploitation attempts involving CVE-2026-111497 have also been recorded, including exploit traffic observed in the wild.