CISA 2026-10-27

CISA KEV — Adobe Commerce and Magento (CVE-2026-48356) +1 more

Machine-generated analysis · WAYSCloud LLM

Adobe Commerce/Magento and Google Brotli have been added to CISA’s KEV catalog due to active exploitation.

Context

The advisory lists CVE-2026-48356 affecting Adobe Commerce and Magento, and CVE-2026-111497 affecting Google Brotli. CISA states these vulnerabilities are actively exploited and are high-risk for publicly exposed assets. It references BOD 26-04, which mandates rapid remediation of KEV items on such assets.

Operator considerations

Check: Verify whether Adobe Commerce, Magento, or Google Brotli are deployed on publicly exposed assets.
Isolate: Segment or restrict network access to systems running the affected components until they are remediated.
Patch: Apply vendor-provided fixes for CVE-2026-48356 and CVE-2026-111497 as soon as possible.
Log: Monitor logs for suspicious file uploads or Brotli processing errors that may indicate exploitation attempts.

From Cybersecurity and Infrastructure Security Agency ↗

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog ...

Read the full advisory on CISA →