Government Advisory

CISA Flags Two More Actively Exploited Flaws in Adobe Commerce, Magento and Google Brotli

CISA · 27 Oct 2026

Key Takeaway Check whether you run Adobe Commerce, Magento or Brotli-dependent software, apply the vendor updates as a priority, and use the KEV Catalog to decide which patches to do first.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence that attackers are already using them. The first is CVE-2026-48356, an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento. The second is CVE-2026-111497, an unchecked return value vulnerability in Google Brotli.

CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors. The agency's Binding Operational Directive 26-04 requires US federal civilian agencies to prioritise rapid fixes for KEV-listed flaws on publicly exposed systems that give attackers total control once exploited. It also sets expectations for checking whether a system was compromised before a patch was applied.

The directive applies only to US federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise fixing KEV Catalog vulnerabilities. Australian businesses running Adobe Commerce, Magento or software that uses Brotli should review their exposure.

CISA KEV Adobe Commerce Magento Google Brotli Vulnerability Management

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.