CISA Adds Two Known Exploited Vulnerabilities to Catalog
Unrated · fetched 2026-10-27
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Remediation
Apply the updates and mitigations in the source advisory; if no fix is available, follow the advisory's guidance on restricting or discontinuing use.
Affected PHP branches
See the source advisory.
Source: CISA Cybersecurity Advisories · retrieved 2026-10-27T16:20:12-04:00 · https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog