Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
Summary
CISA has added two vulnerabilities affecting Adobe Commerce and Magento, as well as Google's Brotli decoder library, to its Known Exploited Vulnerabilities (KEV) catalog. These vulnerabilities are being actively exploited in the wild, with Adobe Commerce systems being particularly targeted by "PolyShell" attacks.
IFF Assessment
The active exploitation of vulnerabilities in widely used e-commerce platforms and libraries represents a significant threat to businesses and their customers.
Severity
The CVSS score of 9.2 indicates a critical severity, likely due to factors such as an easily exploitable attack vector and high impact on confidentiality, integrity, and availability.
CISA KEV: Listed as actively exploited. Federal patch due: November 10, 2026. Known ransomware use: Unknown.
Defender Context
Defenders need to prioritize patching or mitigating vulnerabilities in Adobe Commerce and Magento, as these systems are being actively targeted. Awareness of attacks leveraging the Brotli decoder library is also crucial, as it could be part of a broader exploit chain.