---
title: 'CISA adds two flaws to the KEV catalog: Adobe Commerce and Magento PolyShell and Google Brotli'
url: 'https://securteksecurity.com/news/cisa-kev-adobe-magento-brotli-cve-2026-48356-111497'
markdown: 'https://securteksecurity.com/news/cisa-kev-adobe-magento-brotli-cve-2026-48356-111497.md'
date: '2026-10-27'
description: 'CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on October 27, 2026, based on evidence of active exploitation: CVE-2026-48356, an unrestricted upload of file with dangerous type vulnerability in Adobe Commerce and Magento, and CVE-2026-111497, a Google Brotli unchecked…'
taxonomy:
  category:
    - Cybersecurity
---

# [CISA adds two flaws to the KEV catalog: Adobe Commerce and Magento PolyShell and Google Brotli](https://securteksecurity.com/news/cisa-kev-adobe-magento-brotli-cve-2026-48356-111497)

   27th Oct 2026  

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on October 27, 2026, based on evidence of active exploitation: CVE-2026-48356, an unrestricted upload of file with dangerous type vulnerability in Adobe Commerce and Magento, and CVE-2026-111497, a Google Brotli unchecked return value vulnerability. Both entries carry a federal remediation due date of November 10, 2026 under Binding Operational Directive 26-04, with forensic triage required for publicly exposed assets that grant total control after exploitation. CISA lists ransomware campaign use as unknown for both flaws.

Adobe rates the Commerce and Magento flaw, known as PolyShell, at 9.3 on the CVSS 3.1 scale: it can allow arbitrary code execution in the context of the current user, and Sansec reporting already on this page found it used to upload webshells in the long-running campaign that infected 953 online stores. The Brotli flaw is an out-of-bounds write in the Brotli decoder in versions 1.0.3 through 1.2.0, scored 9.2 on CVSS 4.0 by Google: a remote attacker with no login can use a crafted Brotli stream to corrupt memory, leak sensitive memory, crash the process, or possibly run code. It is fixed in Brotli 1.0.10, 1.1.1 and 1.2.1 and in Node.js 22.23.4, 24.22.1 and 26.12.1, and Sweet Security reported on October 27 that it was observing exploitation attempts across 88 percent of its monitored environments. Both flaws had previously been held on this page for lack of confirmed in-the-wild exploitation; the KEV listing is the new confirming fact.

Sources: [CISA](https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog); [mAlice.ai, Adobe Commerce and Magento](https://malice.ai/a/cisa-adds-adobe-commerce-and-magento-flaw-cve-2026-48356-to-kev-catalog); [Brandefense, Google Brotli](https://brandefense.io/knowledge-hub/vulnerabilities/cve-2026-111497/); [Sweet Security via GlobeNewswire](https://www.globenewswire.com/news-release/2026/10/27/3389353/0/en/sweet-security-offers-all-organizations-affected-by-http2shell-virtual-patching-protection-at-no-cost.html)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [CISA and Five Eyes partners publish guidance on managing AI token consumption](https://securteksecurity.com/news/cisa-five-eyes-guidance-managing-ai-token-consumption.md)
- Next: [CISA adds two Ahsay AhsayCBS flaws to the KEV catalog](https://securteksecurity.com/news/cisa-kev-ahsay-ahsaycbs-cve-2026-105133-105134.md)