cisa.govadvisoryCISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA alert of 27 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog on evidence of active exploitation: CVE-2026-48356, an unrestricted upload of a dangerous file type in Adobe Commerce and Magento, and CVE-2026-111497, an unchecked return value in Google Brotli. It restates BOD 26-04, which makes federal civilian agencies prioritise KEV flaws on exposed assets and check for prior compromise. No technical detail or IOCs are given.
TL;DR CISA adds an exploited Adobe Commerce/Magento file-upload flaw and a Google Brotli unchecked-return-value flaw to the KEV Catalog.
Organisations named here
- BOD 26-04
- CISA
CVEs named here
- CVE-2026-48356
- CVE-2026-111497
Technologies named here
- Adobe Commerce and Magento
- Known Exploited Vulnerabilities Catalog
- Binding Operational Directive 26-04
- CISA KEV Nomination Form
- Adobe Commerce
- Magento
- Brotli
- CISA KEV
- Google Brotli (CVE-2026-111497, Unchecked Return Value)
Techniques named here
- Risk-based vulnerability management
- Compromise checks before patching
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup