CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
About this summary. This is a short excerpt from the description that CISA published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
Source attribution: headline and facts are from CISA (cisa.gov). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder…
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability…
U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog. The…
Adobe security advisory (AV26-697) – Update 1
Serial number: AV26–697 Date: July 14, 2026 Updated: October 27, 2026 On July 14, 2026, Adobe published security advisories to address critical vulnerabilities in the…
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
OverviewOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js…
CISA flags WordPress RCE flaw as actively exploited in attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress…