Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog

Part of the CVE-2026-48356 story · since 26 Oct

Developinglatest 1 hour ago6 articles6 outlets
26 Oct · SecurityWeek firstNowThis article6th of 6
  • Mon 26 Oct, 13:30 UTC. SecurityWeek, first report. Sansec links malware campaign to 953 infected online stores. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 20:30 UTC. The Hacker News, its first report on the story. Sansec finds scanner evasion code infecting 953 online stores. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 21:30 UTC. Security Affairs, its first report on the story. Magento skimmer campaign infects 953 online stores. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 16:30 UTC. Infosecurity, its first report on the story. Sansec finds scanner evasion code on 953 online stores. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds Adobe Commerce and Magento flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 01:00 UTC. SecurityOnline, its first report on the story. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog. Cites a CVE in CISA KEV. This article, 6th of 6.

CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The first is CVE-2026-48356, a critical Unrestricted Upload of File with Dangerous Type flaw affecting Adobe Commerce and Magento. The second is CVE-2026-111497, a high-severity buffer overflow in the Google Brotli decoder. Both flaws are listed as exploited in the wild, with CISA noting evidence of active exploitation for both, and jurisdictions urged to patch by 10 November 2026. Adobe and Google have released fixes for the issues.

For CVE-2026-48356, Adobe’s records indicate that exploitation requires a user to visit a maliciously crafted URL or interact with a compromised page, potentially enabling remote code execution. Affected products include Adobe Commerce 2.4.9 and earlier supported releases, as well as Magento Open Source 2.4.9 and earlier. Patches are available via the 2026-July updates (Adobe APSB26-73) and related 2.4.x/1.x releases.

For CVE-2026-111497, the Google Brotli vulnerability is a buffer overflow in the decoder that can be triggered by sending a crafted Brotli-compressed stream, with potential memory corruption or code execution. Affected Brotli versions run from 1.0.3 through 1.2.0, with fixes in 1.0.10, 1.1.1 and 1.2.1, and vendor updates for bundling products.

Patch guidance, as cited by KEV coverage, lists the applicable versions: Adobe Magento patches up to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, and earlier, plus Brotli updates to 1.0.10, 1.1.1, or 1.2.1. The KEV entry signals that even non-government organisations should prioritise these fixes.

How the story developed

All 6 articles
Developinglatest 1 hour ago6 articles6 outlets

6 articles from 6 outlets since 26 Oct. Still developing; the latest report was 1 hour ago. This was the 6th report, 1 day after the first.

Now26 Oct27First reportSecurityWeek · 26 Oct, 13:30This article6th of 6 · day 2CISA alert27 Oct, 20:01 · official
  • Mon 26 Oct, 13:30 UTC. SecurityWeek, first report. Sansec links malware campaign to 953 infected online stores. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 20:30 UTC. The Hacker News, its first report on the story. Sansec finds scanner evasion code infecting 953 online stores. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 21:30 UTC. Security Affairs, its first report on the story. Magento skimmer campaign infects 953 online stores. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 16:30 UTC. Infosecurity, its first report on the story. Sansec finds scanner evasion code on 953 online stores. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds Adobe Commerce and Magento flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 01:00 UTC. SecurityOnline, its first report on the story. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog. Cites a CVE in CISA KEV. This article, 6th of 6.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 6 articles as a list
  1. Mon 26 OctDay 03
    1. Sansec links malware campaign to 953 infected online stores13:30 · SecurityWeek · First report · Exploited CVE · Known exploited CVE
    2. Sansec finds scanner evasion code infecting 953 online stores20:30 · The Hacker News · Known exploited CVE
    3. Magento skimmer campaign infects 953 online stores21:30 · Security Affairs · Known exploited CVE
  2. Tue 27 OctDay 12
    1. Sansec finds scanner evasion code on 953 online stores16:30 · Infosecurity · Known exploited CVE
    2. CISA adds Adobe Commerce and Magento flaw to KEV catalogue20:01 · CISA · official · CISA alert · Known exploited CVE
  3. Wed 28 OctDay 21
    1. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog01:00 · SecurityOnline · Known exploited CVE · This article, 6th of 6

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in