# CISA KEV adds Adobe Commerce, Brotli flaws

Published: 2026-10-27 · Severity: high · Sectors: Retail, Technology
Canonical: https://vorant.io/reports/48c68633-daa6-5b92-bf31-c8797e665ca2/cisa-kev-adds-adobe-commerce-brotli-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CISA added two actively exploited vulnerabilities—Adobe Commerce/Magento file upload and Google Brotli unchecked return value—to its KEV catalog.

Source: cisa.gov — https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

## What to check

- Applies to: The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-111497 and CVE-2026-48356 as exploited in the wild.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation. The first, CVE-2026-48356, affects Adobe Commerce and Magento and involves unrestricted upload of files with dangerous types, which can allow attackers to upload malicious files (e.g., web shells) to compromise e-commerce platforms. The second, CVE-2026-111497, is an unchecked return value vulnerability in Google Brotli, a widely used compression library embedded in numerous software products and browsers, potentially leading to memory corruption or other downstream issues when exploited.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities that grant total control of publicly exposed assets on a prioritized basis, and to check for prior compromise before patching. While the directive is mandatory only for FCEB agencies, CISA recommends all organizations—particularly those running Adobe Commerce/Magento storefronts or software embedding the Brotli library—treat these as high-priority patching items given confirmed in-the-wild exploitation. Defenders should inventory affected assets, apply vendor patches promptly, and review logs for signs of compromise predating remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-111497 (KEV), CVE-2026-48356 (KEV)

## Detection guidance (public sample)

### PHP Script Written Under Magento Media or Upload Directories

ATT&CK: T1505.003

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux file_event logs. Status: experimental. Generated from the report; not run against telemetry.

Detects PHP-executable files created under Magento pub/media or var/import paths, which hold user-uploaded content and should not contain server-side scripts. This is consistent with web shell drops via unrestricted file upload flaws such as the Adobe Commerce/Magento KEV entry. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP Script Written Under Magento Media or Upload Directories
description: Detects creation of PHP-executable files in Magento upload/media directories
  (pub/media, var/import), where only static content is expected. Consistent with
  web shell placement after an unrestricted file upload exploit against Adobe Commerce/Magento.
tags:
- attack.persistence
- attack.t1505.003
- attack.initial-access
- attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
    - /pub/media/
    - /var/import/
  selection_ext:
    TargetFilename|endswith:
    - .php
    - .phtml
    - .php5
    - .php7
    - .phar
  condition: selection_path and selection_ext
falsepositives:
- Custom Magento modules or deployment scripts that deliberately stage PHP files in
  media directories
- Developers restoring a site backup into the web root
level: high
id: 938294f8-4af4-5b25-9e1d-087375c0d359
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

### Web Server or PHP Process Spawning Shell With Recon or Download Commands

ATT&CK: T1505.003

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects a web server or PHP worker process launching a shell that runs reconnaissance, download or reverse-shell style commands, typical of web shell use after exploiting an upload flaw on an e-commerce platform. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP Process Spawning Shell With Recon or Download Commands
description: Detects php-fpm, php-cgi, Apache or nginx worker processes spawning a
  shell whose command line contains reconnaissance, payload download or reverse-shell
  content. Typical of web shell activity following an unrestricted file upload on
  Adobe Commerce/Magento.
tags:
- attack.persistence
- attack.t1505.003
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /php-fpm
    - /php-cgi
    - /php
    - /httpd
    - /apache2
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - uname -a
    - /etc/passwd
    - base64 -d
    - /dev/tcp/
    - 'curl '
    - 'wget '
    - nc -e
    - chmod +x
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications or admin panels that legitimately shell out to curl or wget for
  update checks
- Deployment or health-check scripts triggered through PHP
level: high
id: ed3c5626-3b8b-5b86-b341-31a09d24ef38
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/48c68633-daa6-5b92-bf31-c8797e665ca2/cisa-kev-adds-adobe-commerce-brotli-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup