CISA Adds Brotli and Adobe Commerce Flaws to Known Exploited Vulnerabilities Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. CVE-2026-111497 affects Google’s Brotli data compression library and can lead to code execution, information disclosure, or denial of service when specially crafted compressed data is processed. The flaw impacts any software that incorporates the Brotli decoder for decompression tasks, prompting vendors to release updates. CVE-2026-48356 resides in the file upload functionality of Adobe Commerce and Magento, allowing attackers to exploit improper handling during upload operations. CISA issued the alert on October 27, 2026, urging organizations to apply patches immediately to mitigate ongoing attacks. Related advisories also reference Brotli fixes in PHP and other products that bundle the library.
Security NEXTOct 28, 2026Translated from Japanese