Two CISA KEV additions: patch Node.js Brotli and Adobe Commerce now

Status: Confirmed — 28 October 2026. CISA added both CVE-2026-111497 and CVE-2026-48356 to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Their CVE publication dates are 22 October 2026 and 14 July 2026 respectively; the KEV addition is recent, not the underlying disclosure.

At a glance

CVE-2026-111497. NVD records CVSS 4.0 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H); its EPSS on 27 October was 0.55483 (99.03rd percentile). Node.js says malformed Brotli supplied to an application using node:zlib can corrupt decoder memory, causing a crash, disclosure or potentially code execution. The affected lines are confirmed; a compromise of any particular service is not confirmed.

CVE-2026-48356. Adobe rates it CVSS 3.1 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); EPSS on 27 October was 0.30582 (98.23rd percentile). Adobe describes an unrestricted dangerous-file upload issue that can lead to privilege escalation. Adobe's July bulletin said it was not aware of in-the-wild exploitation then; CISA's later KEV listing confirms exploitation exists, but does not identify a particular shop or campaign.

Our urgency assessment is Critical for an internet-facing Adobe Commerce/Magento site and High for a Node.js service that accepts untrusted compressed data. CVSS and EPSS are inputs, not proof of exposure.

Are you affected?

Node.js: establish version and data path safely

On each supported host or container image, run:

node --version
node -p "process.versions.brotli"

Record the output, the image digest or package revision, and whether the service uses node:zlib to decompress Brotli from clients, reverse proxies, queues or stored uploads. A release earlier than 22.23.4, 24.22.1 or 26.12.1 on the stated lines is affected; an absent Node runtime is not affected by this Node.js issue. A version check does not prove that hostile Brotli reached the process, and you must not test this by sending malformed input.

NetTools.tech: no safe relevant external check exists. Internet scanning cannot establish a private runtime version or decoder call path.

Adobe Commerce / Magento: establish the installed release

In the Commerce root, use the approved deployment account:

bin/magento --version
composer show magento/product-community-edition magento/product-enterprise-edition 2>/dev/null

Compare the result with APSB26-73. Adobe lists Commerce 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, and 2.4.4-p18 and earlier; Magento Open Source 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, and 2.4.6-p15 and earlier. The bulletin also covers the corresponding B2B packages and Commerce Events 1.6.0–1.20.0.

Capture the command output and the deployed Composer lock file. An affected installed version means patching is required. It does not prove exploitation. Do not upload a test file or probe a live shop.

Patch Node.js

Prerequisites: a tested deployment/rollback path, a current backup or immutable image, a maintenance window and application health checks.

1. Update the runtime through your supported package, image or platform channel to Node.js 22.23.4, 24.22.1 or 26.12.1, or a later supported security release. Do not mix binaries across architectures.
2. Rebuild dependencies and redeploy through the normal CI/CD pipeline. Restart the service using its existing supervisor.
3. Run node --version in the deployed workload and exercise the normal authenticated health check.

Expected result: the running workload reports the selected fixed version and remains healthy. Validate deployment logs, application error rate and a normal user journey.

Containment while change is pending: remove public routes that accept compressed uploads or responses only where the application and change owner confirm this will not break required traffic; otherwise restrict the service to trusted ingress. This reduces exposure but is not a vendor fix.

Rollback: revert to the previous known-good image only if the fixed deployment fails operational validation; restrict or disable the untrusted decompression path before restoring the vulnerable runtime, then escalate the compatibility issue.

Patch Adobe Commerce / Magento

Prerequisites: tested database and media backup/restore, a staging deployment, maintenance window, SSH/deployment access and a documented payment/order validation plan.

1. In staging, use Adobe's APSB26-73 installation link for your exact release line. Update to the bulletin's July 2026 target, for example 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul or 2.4.4-2026-jul where applicable.
2. Apply the same supported Composer-based update in the normal pipeline; do not copy individual vendor files or install an unverified ZIP.
3. Run the vendor deployment steps required for your environment, including bin/magento maintenance:enable, the documented update/dependency steps, bin/magento setup:upgrade, bin/magento cache:flush, and bin/magento maintenance:disable only after validation.
4. Confirm bin/magento --version, complete an authorised test checkout and verify admin login, catalogue, cron and payment integration.

Expected result: the version matches the APSB26-73 fixed line; maintenance mode clears and normal transactions succeed. Preserve deployment logs, Composer lock file and test evidence.

Containment: if patching cannot occur in the window, place the affected storefront behind approved maintenance mode or restrict it to trusted access. A WAF rule alone is not a verified remediation for this vulnerability.

Rollback: restore the tested application/database backup according to the change plan if the update fails, then keep the store in maintenance mode or otherwise restricted until a supported fixed deployment is available. Do not silently return an affected public shop to service.

Timeline

• 14 July 2026: Adobe published APSB26-73 for CVE-2026-48356.
• 22 October 2026: CVE-2026-111497 was published; Node.js released fixed versions in its 21 October security release.
• 27 October 2026: CISA added both CVEs to KEV, with a 10 November due date for covered federal agencies.
• 28 October 2026: this assessment was verified against vendor notices, NVD, CISA KEV and FIRST EPSS.

Changes log

• 28 October 2026 — R1: Initial publication. Records original publication dates separately from the KEV addition date.

References

1. Node.js — 21 October 2026 security releases
2. Adobe APSB26-73 — Security update for Adobe Commerce
3. CISA KEV — CVE-2026-111497
4. CISA KEV — CVE-2026-48356
5. NVD — CVE-2026-111497
6. FIRST EPSS API