CISA adds exploited Adobe Commerce and Brotli flaws to mandatory patch list

The U.S. Cybersecurity and Infrastructure Security Agency added Adobe Commerce and Google Brotli vulnerabilities to its Known Exploited Vulnerabilities catalog on October 27, citing active exploitation. Federal Civilian Executive Branch agencies must apply fixes by November 10, 2026. Sansec reported that attackers used the Adobe Commerce flaw, CVE-2026-48356, to breach hundreds of stores and install a loader that retrieves attacker-controlled code. Security firms also detected exploitation attempts against Brotli, a compression library used across software projects. The Brotli flaw exposes applications that decompress attacker-controlled data. Node.js fixed it in versions 22.23.4, 24.22.1, and 26.12.1. Sysdig said demonstrated effects include crashes at scale and code execution in a narrow configuration, making reachability important when prioritizing patches.