CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring immediate action from organizations.

The vulnerability or weakness

CVE-2026-48356, an unrestricted upload of file with dangerous type vulnerability in Adobe Commerce and Magento, and CVE-2026-111497, an unchecked return value vulnerability in Google Brotli, pose significant risks.

CVECVSSSeverityIn CISA KEVKEV due date
CVE-2026-1114979.2CRITICALYes, added 2026-10-272026-11-10
CVE-2026-483569.3CRITICALYes, added 2026-10-272026-11-10

CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.

Earlier attacks and coverage

Business impact

Organizations may face operational disruptions, financial losses, and legal repercussions if these vulnerabilities are exploited, leading to potential data breaches and service outages.

Industries affected

These vulnerabilities impact a wide range of industries, including e-commerce, web hosting, and cloud services.

Users affected

Users of Adobe Commerce and Magento and Google Brotli products are advised to apply mitigations and follow CISA’s guidance to prevent potential attacks.

Build these skills

Watch the daily brief

Sources

← Previous: CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets