Act
active
Adobe Commerce PolyShell attacks exploiting KEV-listed RCE flaw
- Engineer — Act: CVE-2026-111497 is CISA KEV-listed with EPSS 0.88 and a public PoC — patch Adobe Commerce/Magento to the latest vendor-released version immediately, and audit web server logs for PolyShell indicators and anomalous Brotli-encoded traffic.
- SOC/IR — Act: Hundreds of stores are actively compromised; hunt for PolyShell webshell artifacts and Brotli-encoded C2 traffic in web access logs since KEV listing date, and tune WAF/SIEM rules to flag unusual POST patterns on Commerce endpoints.
- Leader — Plan: If your org runs Adobe Commerce or Magento storefronts — or relies on a third-party e-commerce vendor that does — confirm patching status and request a written attestation; breach of payment pages may trigger PCI DSS incident-notification obligations.
- Signals: CVE-2026-111497 — CISA KEV: listed, EPSS 0.88, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.