CISA Adds Two Actively Exploited Vulnerabilities (CVE‑2026‑48356, CVE‑2026‑111497) to KEV Catalog
CISA placed two high‑risk CVEs—Adobe Commerce/Magento file‑upload and Google Brotli unchecked return‑value—in its Known Exploited Vulnerabilities catalog, signaling confirmed in‑the‑wild attacks. Organizations should treat these as priority patching items to meet vulnerability‑management controls across frameworks.
ADTP Breach Watch· October 27, 2026· US-CERT Current Activity
SeverityHigh
Type🐛 Advisory
ConfidenceHigh
ReportedOct 27, 2026
Technology & SaaSTECH_SAASVulnerability Exploit
What happened
On October 27 2026, CISA announced that CVE‑2026‑48356 (an unrestricted file‑upload flaw in Adobe Commerce and Magento) and CVE‑2026‑111497 (an unchecked return‑value bug in Google’s Brotli library) have been added to the agency’s Known Exploited Vulnerabilities (KEV) Catalog. Both vulnerabilities have documented evidence of active exploitation and grant attackers full control of compromised assets. The alert references Binding Operational Directive 26‑04, which mandates rapid remediation of KEV items on publicly exposed federal systems and encourages the broader community to adopt the same risk‑based patching approach.
Why it matters for trust and compliance
These additions test the control objective of timely vulnerability management; evidence of prompt remediation can satisfy multiple framework requirements in one go.
Provides a concrete trigger for continuous vulnerability‑management monitoring.
Enables collection of remediation evidence that maps to audit‑ready controls across frameworks.
Who is affected
TECH_SAAS
Recommended actions
Run an inventory to locate all Adobe Commerce/Magento instances and any software using the Brotli library.
Apply vendor patches or mitigations for CVE‑2026‑48356 and CVE‑2026‑111497 immediately.
Document patch dates and verification results in your control‑evidence repository.
Details
CVEs
CVE-2026-48356, CVE-2026-111497
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.