CISA Adds Two Actively Exploited Vulnerabilities (CVE‑2026‑48356, CVE‑2026‑111497) to KEV Catalog
What It Is — The U.S. Cybersecurity & Infrastructure Security Agency (CISA) announced that two CVEs have been added to its Known Exploited Vulnerabilities (KEV) Catalog, indicating confirmed, in‑the‑wild exploitation.
- CVE‑2026‑48356 – A file‑upload flaw in Adobe Commerce and Magento that allows an attacker to upload files of a dangerous type without restriction, potentially leading to remote code execution.
- CVE‑2026‑111497 – An unchecked return‑value issue in Google’s Brotli compression library that can be leveraged to achieve arbitrary code execution under certain conditions.
Both vulnerabilities are classified as high‑risk because successful exploitation grants the adversary full control of the affected asset. CISA’s Binding Operational Directive 26‑04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV items on publicly exposed systems, and it encourages all organizations to adopt the same risk‑based patching discipline.
Affected Products – Adobe Commerce / Magento (any version vulnerable to CVE‑2026‑48356) and any software that incorporates the vulnerable Google Brotli library (CVE‑2026‑111497).
Why It Matters for Trust & Control Assurance – The incident tests the control objective of timely vulnerability management and patch remediation; demonstrating evidence of remediation satisfies many framework requirements in a single step.
Recommended Actions –
- Identify any assets running Adobe Commerce/Magento or using the Brotli library.
- Prioritize patching or applying vendor‑provided mitigations for the two CVEs.
- Record remediation dates and evidence in your continuous compliance repository.
- Verify that the patches are effective and that no residual exploitation is observed.