CISA Flags Adobe Commerce, Magento and Google Brotli Flaws as Exploited

Key points

• CISA placed two CVEs on its Known Exploited Vulnerabilities list on Oct. 27, 2026.
• The flaws involve Adobe Commerce, Magento and Google Brotli.
• Exploitation in the wild raises risk across federal networks.
• Successful abuse could give attackers complete control of affected assets.
• Federal civilian departments are expected to make fixes a top priority.

CISA on Oct. 27, 2026, placed two security flaws on its Known Exploited Vulnerabilities list, signaling that attackers are already using them. The entries cover CVE-2026-48356 and CVE-2026-111497, tied to Adobe Commerce, Magento and Google Brotli. For federal civilian departments, the listing changes the risk calculation from theoretical exposure to confirmed hostile activity.

The affected surface spans commerce platforms and a widely used compression component. Adobe Commerce and Magento sites often hold customer data, payment workflows and administrative access, while Google Brotli is embedded in web delivery paths. That combination matters because exploitation in the wild can lead to complete control of affected systems, not just limited data exposure.

The federal enterprise risk is elevated because these products are common in public-facing services and internal web infrastructure. A flaw that grants full control over an asset can become a foothold for lateral movement, credential theft or tampering with transactions. The KEV listing also means delay is not a neutral choice: agencies that leave exposed instances online are accepting known exploitation risk.

Context matters here. CISA’s catalog is a signal to prioritize patching and mitigation across federal networks, and vendors Adobe and Google are central to the remediation path. Administrators should treat both CVEs as urgent, confirm which systems run the affected components, and apply vendor fixes without waiting for a broader refresh cycle.

What to watch: updated vendor guidance, any expansion of the KEV entry, and evidence of scanning or exploitation attempts against commerce endpoints and Brotli-enabled services. Teams should also watch for follow-on activity such as new administrative accounts, altered payment settings or unusual outbound connections after patching.

What to do now

1. Inventory all Adobe Commerce, Magento and Google Brotli deployments, including internet-facing and internally proxied instances.
2. Apply vendor security updates that address CVE-2026-48356 and CVE-2026-111497, starting with externally reachable systems.
3. If patching cannot be completed immediately, apply vendor mitigations and restrict administrative or unnecessary public access.
4. Hunt for exploitation signs: anomalous admin logins, new accounts, modified commerce settings, webshells and unusual outbound traffic.
5. Rotate credentials and secrets used by affected commerce and web infrastructure after suspicious activity is found.
6. Verify backups and recovery procedures for commerce data before making high-risk changes.
7. Report confirmed or suspected compromise to CISA and internal incident response channels promptly.

CVE references

• CVE-2026-48356
• CVE-2026-111497

Original source

CISA Advisories