The US Cybersecurity and Infrastructure Security Agency (CISA) says attackers are now exploiting two critical flaws: one in Adobe Commerce and Magento, the widely used e-commerce platform, and one in Google's Brotli compression library, the bug that has spent the past week forcing patches across Node.js, Envoy, Istio and other web plumbing. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on October 27, "based on evidence of active exploitation."
A KEV listing is CISA's way of saying a bug has moved from theoretical to real. US federal civilian agencies are required to prioritize fixing listed flaws, and CISA urges every other organization to do the same. The agency's alert does not say who is exploiting either bug, against whom, or at what scale.
A Magento upload flaw rated 9.3
The more severe entry by score is CVE-2026-48356, which CISA lists as an Adobe Commerce and Magento "unrestricted upload of file with dangerous type" vulnerability. Its NVD record carries a CVSS score of 9.3 and says it could result in arbitrary code execution in the context of the current user. The same record notes that exploitation requires user interaction, with a victim visiting a maliciously crafted URL or interacting with a compromised web page. The NVD entry dates to July 14, so a fix has been available for months. Adobe's own security bulletin carries the affected versions and patch detail.
Adobe Commerce has been here recently. CISA flagged a different Adobe Commerce flaw as exploited in September, alongside a WSO2 bug, as we reported at the time.
Brotli moves from patch rush to live attacks
The second entry, CVE-2026-111497, is the Brotli decoder bug that researchers have nicknamed Broccoli2Shell. CISA's catalog labels it a Google Brotli "unchecked return value" vulnerability. The NVD record, scored 9.2, describes a buffer overflow in the Brotli decoder in versions 1.0.3 through 1.2.0 that lets a remote, unauthenticated attacker corrupt decoder memory, disclose memory contents, cause a denial of service or potentially execute code using a crafted Brotli-compressed stream.
That is a short road from disclosure to exploitation. Node.js shipped its fix last week (our report), and within days patched builds followed for Bun, Envoy, Istio and the Python bindings (our follow-up). Because Brotli decompression happens automatically inside web servers, proxies and runtimes, many affected copies sit in places nobody thinks to inventory.
Update Brotli to 1.0.10, 1.1.1 or 1.2.1
- Brotli: the NVD record says any Brotli library or binary from 1.0.3 through 1.2.0 should move to 1.0.10, 1.1.1 or 1.2.1. Bundled copies count too: Node.js, Bun, Envoy, Istio and the language bindings each ship their own fixed release.
- Adobe Commerce and Magento: apply the fix in Adobe's bulletin for CVE-2026-48356 and review stores for signs of compromise.
- Check, then patch: CISA's binding directive expects federal agencies to check whether a system was compromised before the patch went on. That is sound advice for anyone who was slow on either fix.
Neither bug is new, and that is the point. A week ago Brotli was a patch-management story. CISA's listing turns it into an incident-response one for anyone who has not finished.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.