# CISA adds exploited Adobe Commerce and Brotli flaws to mandatory patch list

_Published Wednesday, October 28, 2026 at 4:06 AM EDT · Security · Latest · Tier 2 — Notable_

![CISA adds exploited Adobe Commerce and Brotli flaws to mandatory patch list — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1vdoV4q9cDhhxBpH2lDPkUPc4WTkuwSmH93IS6MDM8fSYR4ZsKEakfK54cvOjHMFYGJA7Hri87MShqbPweb0BNmEXEsKJErbferZyq7_m7XdHLrb2bgmps_Bs_nu_w7RCiade8PPKSYv6NpxnWTG8pJD5CIUvI2E_cfWMqNBFTl4MXm2WKZaqL_T0DaO-/s1700-nu-rw-lo-l85-e365/cisa-warning.jpg)

The U.S. Cybersecurity and Infrastructure Security Agency added Adobe Commerce and Google Brotli vulnerabilities to its Known Exploited Vulnerabilities catalog on October 27, citing active exploitation. Federal Civilian Executive Branch agencies must apply fixes by November 10, 2026.

Sansec reported that attackers used the Adobe Commerce flaw, CVE-2026-48356, to breach hundreds of stores and install a loader that retrieves attacker-controlled code. Security firms also detected exploitation attempts against Brotli, a compression library used across software projects.

The Brotli flaw exposes applications that decompress attacker-controlled data. Node.js fixed it in versions 22.23.4, 24.22.1, and 26.12.1. Sysdig said demonstrated effects include crashes at scale and code execution in a narrow configuration, making reachability important when prioritizing patches.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html)

---
Canonical: https://techandbusiness.org/newswire/i9wgELF_DOwLoaxcR2AJ8t
Published: 2026-10-28T08:06:23.316Z
Story chronology: 2026-10-27T00:00:00.000Z
Retrieved: 2026-10-28T11:02:56.699Z
Publisher: Tech & Business (techandbusiness.org)