CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog

TL;DR

On October 27, CISA added two actively exploited flaws to its Known Exploited Vulnerabilities list, better known as the CISA KEV catalog. The first, CVE-2026-48356, hits Adobe Commerce and Magento. The second, CVE-2026-111497, is a Brotli vulnerability in Google’s widely used compression library.

CISA says it has evidence of active exploitation for both flaws. Federal agencies must patch by November 10, 2026. Fixes already exist for both bugs.

Why It Matters

A spot in the CISA KEV catalog means attackers are already using a flaw. As CISA puts it, “These types of vulnerabilities are a frequent attack vector for malicious cyber actors.” Online stores run Magento, while Brotli sits inside web servers, runtimes and firewalls.

However, CISA has not shared who is behind the attacks. It also lists ransomware use as “Unknown” for both.

How the Attack Works

Adobe Commerce and Magento

CVE-2026-48356 (CVSS 9.3) is an unrestricted file upload bug. According to Adobe’s record, an attack requires that “a victim must visit a maliciously crafted URL or interact with a compromised web page.” It could then lead to code execution.

Google Brotli

The Brotli vulnerability (CVSS 9.2) is a buffer overflow in the decoder. A remote attacker sends “a crafted Brotli-compressed stream” to corrupt memory, leak data or possibly run code. Node.js, .NET and PAN-OS shipped fixes for it this month.

Affected Versions

• Adobe Commerce 2.4.9, 2.4.8-p5 and earlier supported releases, plus Magento Open Source 2.4.9 and earlier
• Google Brotli 1.0.3 through 1.2.0

Patch and Mitigation

Adobe fixed the Magento flaw in July 2026 under bulletin APSB26-73. Install the matching 2026-jul patch for your release.

For Brotli, update to 1.0.10, 1.1.1 or 1.2.1. Also, apply vendor updates for products that bundle the library.

Even outside government, any entry in the CISA KEV catalog deserves top patch priority.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.