CISA Adds Two Known Exploited Vulnerabilities to Catalog
Summary
CISA has added two vulnerabilities, CVE-2026-48356 affecting Adobe Commerce/Magento and CVE-2026-111497 in Google Brotli, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This action aligns with Binding Operational Directive (BOD) 26-04, which mandates federal agencies to prioritize patching these high-risk vulnerabilities on publicly exposed assets.
IFF Assessment
The article highlights the addition of actively exploited vulnerabilities to a government catalog, indicating active threats that defenders must address.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: November 10, 2026. Known ransomware use: Unknown.
Defender Context
Defenders should prioritize patching the newly added vulnerabilities (CVE-2026-48356 and CVE-2026-111497) on any relevant systems, especially those exposed externally. Organizations should align their vulnerability management practices with CISA's BOD 26-04 by focusing on actively exploited flaws listed in the KEV Catalog.