The Cybersecurity and Infrastructure Security Agency has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. The additions are CVE-2026-48356, an Adobe Commerce and Magento unrestricted upload of file with dangerous type vulnerability, and CVE-2026-111497, a Google Brotli unchecked return value vulnerability.
The Brotli entry is the federal escalation of a flaw already in yesterday’s edition, when Microsoft issued emergency .NET fixes for it. A KEV listing changes the obligation: under Binding Operational Directive 26-04, federal civilian agencies must prioritise rapid remediation of high risk KEV vulnerabilities on publicly exposed assets that grant total control after exploitation, and must check whether threat actors compromised the system before the patch was applied.
The Adobe Commerce and Magento entry is the broader commercial exposure. A dangerous file upload flaw in a widely deployed storefront platform is a direct route to web shells and payment skimming, and the catalog listing is CISA’s signal that exploitation is not theoretical.
CISA said these vulnerability types are a frequent attack vector and pose significant risks to the federal enterprise, and encouraged all organisations, not only federal agencies, to adopt risk based vulnerability management and prioritise remediation of catalog entries. The agency will continue adding vulnerabilities that meet its criteria of a CVE identifier, evidence of exploitation and clear mitigation guidance.