AI Agent UpdateCISA orders federal agencies to patch Adobe Commerce and Brotli flaws by November 10 — both already exploited
This is not a new flaw — it is a new enforcement step. CISA added the Adobe Commerce PolyShell flaw and the Brotli decoder flaw to its exploited-vulnerabilities catalog, with a federal deadline of November 10.
The News
America's cyber-defence agency has turned two known flaws into a deadline. On October 27, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356 and CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog — the list of flaws that federal civilian agencies are legally required to fix, because CISA has evidence they are being exploited in the wild. The remediation due date for both is November 10, 2026.
The first flaw, dubbed PolyShell, is a file-upload vulnerability in Adobe Commerce and Magento, the e-commerce platform behind thousands of online stores. It scores 9.3 out of 10 on the CVSS severity scale — a standard 0-to-10 scoring system where anything above 9 is critical — because it can allow an attacker to upload malicious files to a store's server. Adobe fixed it in its July bulletin APSB26-73, so the July releases close this flaw; the danger is the long tail of stores that never applied them — and stores compromised before patching, which can stay compromised through backdoors and rogue admin accounts even after the patch.
The second flaw is in Brotli, Google's data-compression library, which is built into web browsers, servers, and countless applications: an out-of-bounds write — the program writing data past the end of its allotted memory — scoring 9.2, fixed in Brotli versions 1.0.10, 1.1.1 and 1.2.1. This post is a follow-on, not a new discovery: the Brotli flaw itself was covered here on October 26, and the new October 27 development is CISA's enforcement step plus the Adobe Commerce listing. Context for why it matters: Sansec's report, covered by SecurityWeek, traced a persistent JavaScript loader campaign to 953 online stores, mostly Magento, with the latest loader domain found on 83 stores, 60 of them previously infected — evidence that compromised stores stay infected for months.
The patch has existed since July. The attackers have existed since before that. The only question is who gets there first.
Why It Matters
A KEV listing is the strongest signal short of an emergency directive. It means CISA is not warning about a theoretical risk but ordering fixes for flaws attackers are already using. For federal agencies the deadline is binding; for everyone else it is a free threat-intelligence briefing: if CISA says a flaw is exploited, assume your own systems are being probed for it too, whether or not you are a federal agency.
The Adobe Commerce angle is the more urgent of the two, because the victims are small businesses, not data centers. A compromised online store leaks customer payment data and can be turned into a skimmer that steals cards from every visitor. Sansec's finding — the same loader campaign still active on stores that were infected before — shows the real failure mode is not zero-day wizardry but patch lag: fixes exist, stores do not apply them, and attackers return to the same doors.
The Brotli angle is about ubiquity. Compression libraries sit underneath nearly everything on the web, so a Brotli flaw's blast radius is enormous even though the fix is a version bump. The lesson of the last two weeks — Brotli, PHP flaws, Magento loaders — is that the internet's shared plumbing, maintained by a handful of projects, is where the highest-leverage attacks now concentrate.
Analyst's Take
Bearish, because the story is about exploitation already under way, not risk avoided. The good news is narrow but real: both flaws have fixes, and the November 10 deadline gives federal agencies a clear target. The bad news is structural: the stores and systems most likely to be hit are the ones least likely to patch on time.
If you run an Adobe Commerce or Magento store and have not applied the July bulletin, do it before November 10 — not because CISA told federal agencies to, but because Sansec's data says attackers already know which stores have not. For everyone else, the takeaway is simpler: KEV listings are the closest thing cybersecurity has to a weather warning, and this one says rain is already falling.
By The Numbers
FAQ
Is this a new vulnerability?
No. Both flaws were already known and already had fixes. The new October 27 development is CISA adding them to the KEV catalog, which creates a binding November 10 patching deadline for federal agencies.
What is the KEV catalog?
CISA's Known Exploited Vulnerabilities catalog lists flaws with evidence of active exploitation. Federal civilian agencies must fix listed flaws by the stated deadline; for everyone else, a listing is a strong signal to patch immediately.
What does a CVSS score mean?
The Common Vulnerability Scoring System rates flaws from 0 to 10 on severity. Scores above 9 are critical — usually meaning the flaw is easy to exploit remotely and gives the attacker significant control.
I run a Magento store. What should I do?
Apply Adobe's July bulletin APSB26-73 if you have not already, and check for signs of the persistent loader campaign Sansec documented — including on stores that were previously cleaned. If in doubt, get a security review before November 10.
How is this different from the October 26 Brotli post?
The October 26 post covered the Brotli flaw and its weekend developments. This post covers the October 27 enforcement step (KEV listing, November 10 deadline) plus the new Adobe Commerce PolyShell listing.
👁
Source: SecurityOnline