CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog—CVE-2026-48356 (Adobe Commerce/Magento unrestricted upload of files with dangerous types) and CVE-2026-111497 (Google Brotli unchecked return value)—based on evidence of active exploitation. The advisory reminds Federal Civilian Executive Branch agencies of Binding Operational Directive 26-04 to prioritize rapid remediation of KEV-listed high-risk vulnerabilities on publicly exposed assets, encourages all organizations to adopt risk-based vulnerability management, and describes how to nominate additional exploited vulnerabilities for inclusion in the KEV Catalog.