tag: Adobe-Commerce · 3 items
- Engineer — Act: CVE-2026-111497 is CISA KEV-listed with EPSS 0.88 and a public PoC — patch Adobe Commerce/Magento to the latest vendor-released version immediately, and audit web server logs for PolyShell indicators and anomalous Brotli-encoded traffic.
- SOC/IR — Act: Hundreds of stores are actively compromised; hunt for PolyShell webshell artifacts and Brotli-encoded C2 traffic in web access logs since KEV listing date, and tune WAF/SIEM rules to flag unusual POST patterns on Commerce endpoints.
- Leader — Plan: If your org runs Adobe Commerce or Magento storefronts — or relies on a third-party e-commerce vendor that does — confirm patching status and request a written attestation; breach of payment pages may trigger PCI DSS incident-notification obligations.
- Signals: CVE-2026-111497 — CISA KEV: listed, EPSS 0.88, public PoC on GitHub
- Engineer — Act: Both flaws are CISA KEV-listed with confirmed active exploitation; patch WSO2 API Control Plane (CVE-2026-5430, CVSS 9.8) and Adobe Commerce/Magento immediately — a public PoC is on GitHub, lowering the bar for opportunistic exploitation.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation of both products; sweep web and API gateway logs for path traversal patterns targeting WSO2 API Control Plane and audit Adobe Commerce instances for webshell drops or unauthorized file access since the PoC became public.
- Leader — Plan: Confirm whether WSO2 API Control Plane or Adobe Commerce is in your environment and direct engineering to treat these as this-week patches; Adobe Commerce’s payment-processing role adds PCI DSS urgency if applicable.
- Signals: CVE-2026-5430 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active exploitation attempts against CVE-2026-71362 in Adobe Commerce and Magento have been observed despite low EPSS — if you run either platform, patch immediately and audit recent customer authentication logs for signs of account takeover.
- SOC/IR — Plan: No IOCs or ATT&CK-mapped TTPs are available yet, but active exploitation is reported; build or tune detections for anomalous authentication patterns and privilege changes on Commerce/Magento instances in your estate.
- Leader — Plan: If your organization or a key e-commerce vendor runs Adobe Commerce or Magento, confirm patching status this week and assess whether customer account data may have been exposed, given the reported exploitation activity.
- Signals: CVE-2026-71362 — CISA KEV: not listed, EPSS 0.00, no public PoC found