On Tuesday, October 27, 2026, CISA added two bugs to its Known Exploited Vulnerabilities catalog: an unrestricted file upload flaw in Adobe Commerce and Magento Open Source, CVE-2026-48356, and an unchecked return value in Google’s Brotli compression library, CVE-2026-111497. Both carry a federal due date of November 10, 2026. Four days earlier, on October 23, CISA listed a SQL injection bug in on-premises Arista VeloCloud Orchestrator, CVE-2026-114625, with a due date of October 26, three days after listing.
The three entries have one thing in common for a finance or security leader: in each case the fix is probably not in your own hands. A storefront is often run by an agency or host. Brotli ships inside other products. A VeloCloud Orchestrator is often managed by a network provider. The work this week is to find out who owns each patch and to get a dated answer from them.
What happened
- July 14, 2026: Adobe published bulletin APSB26-73 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. It fixes 14 CVEs. CVE-2026-48356 is the highest rated, listed by Adobe as critical, CVSS 3.1 base score 9.6, with no authentication required. NVD’s record, published the same day, scores it 9.3 and notes that a victim must visit a crafted URL or interact with a compromised page. At publication Adobe said it was “not aware of any exploits in the wild.” The bulletin was last updated August 11.
- October 21: Google’s Brotli project released version 1.2.1. The release notes list one security item: CVE-2026-111497, an “out-of-bounds write” that “permits remote code execution.”
- October 22: NVD published the Brotli record. It says Brotli versions 1.0.3 through 1.2.0 are affected on all platforms, and that users should move to 1.0.10, 1.1.1 or 1.2.1. The same day Arista published Security Advisory 0199 for VeloCloud Orchestrator, rated CVSS 3.1 9.9, and said the issue “was detected by Arista and is known to be actively exploited.”
- October 23: CISA added the Arista bug to the catalog with forensic triage required, along with a Collabora Online bug that only affects the built-in CODE server app for Nextcloud (CVE-2026-110447).
- October 27: CISA added the Adobe and Brotli bugs in catalog version 2026.10.27. For both, the catalog lists known ransomware use as “Unknown” and forensic triage as not required.
Adobe Commerce and Magento: CVE-2026-48356
CISA describes the flaw as an unrestricted upload of a file with a dangerous type “that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session.” Adobe’s bulletin lists the affected releases as Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier; Adobe Commerce B2B 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 and earlier; and Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier. The fixed builds carry a “2026-jul” suffix, such as 2.4.8-2026-jul.
The gap matters. The patch has been out since July. A store that applied it is in a different position from one that has not been touched since spring. Adobe’s “not aware of any exploits” line was written in July, and CISA now says the bug is being used.
Google Brotli: CVE-2026-111497
Brotli is a compression format used on the web and inside many applications. CISA’s entry says a crafted Brotli-compressed stream can let a remote, unauthenticated attacker “corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.” The catalog flags it as affecting “an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products.”
You cannot patch Brotli by itself in most cases. It sits inside web servers, browsers, language runtimes, appliances and SaaS back ends. The fix arrives when each of those vendors ships an updated build. The question for a vendor is narrow: does your product include Brotli 1.0.3 through 1.2.0, and when will it move to a fixed release?
Arista VeloCloud Orchestrator: CVE-2026-114625
VeloCloud Orchestrator is the management console for VeloCloud SD-WAN, formerly sold by Broadcom. Arista’s advisory says that on an affected on-premises system “any authenticated user can gain operator privileges” and act as a local superuser operator. The lowest built-in tenant role, Enterprise Read Only, is enough. Arista says hosted and dedicated versions were already patched.
Affected releases are 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Arista says end-of-support versions have not been assessed. It lists two source IP addresses seen in the attacks, 74.82.197.86 and 38.54.50.151, and asks operators to preserve web, application, system and database logs before fixing a system they suspect was compromised. The federal due date passed on October 26.
What it means for CFOs/CISOs
For a CFO, each of these bugs is a contract question first. If an agency runs the storefront, does the agreement say who applies security patches, and how fast? If a managed network provider runs the orchestrator, does the contract give you the right to ask for a patch date and logs? If the answer is “nobody wrote that down,” the cost of finding out arrives during an incident, when it is highest.
For a CISO, the Brotli entry is the harder one. It is a supply-chain item. Your inventory will not list Brotli unless you hold software bills of materials for the products you run. The Magento and VeloCloud entries are simpler: either you run the product or you do not, and the version number answers the rest.
The federal due dates bind federal civilian agencies under BOD 26-04, not private companies. They are still a fair benchmark for a board or an insurer asking how quickly you responded.
What to do this week
- Storefront. If you sell online on Adobe Commerce or Magento, ask whoever runs it, in writing, for the installed version and whether it is a 2026-jul build or later. Ask them to check for unexpected uploaded files. Record the answer and the date.
- Brotli. Send key vendors a one-line question: “Does your product ship Brotli 1.0.3 through 1.2.0, and when will you ship 1.0.10, 1.1.1, 1.2.1 or later?” Log answers, and any open item, in a risk exception register with an owner and an expiry. The SBOM request pack builds the longer version of the ask.
- SD-WAN. Confirm whether your VeloCloud Orchestrator is on premises or hosted. If it is on premises, check the version against the fixed releases, restrict the web interface to administrative networks, and search logs for the two IP addresses Arista published.
- Contracts. At the next renewal of any agency, host or managed network contract, add a patch timeline and a log-access clause. The software renewal scorecard has a place to note it.
Contract terms at renewal. The patch-timeline and log-access questions above are easiest to win at renewal. The Renewal Audit reviews up to 25 software renewals for a fixed $199 and returns a written report in 5 business days. If you would rather run it yourself, the Renewal & Risk Operator Pack ($29) has spreadsheet versions of the renewal scorecard and the risk exception register.
What to watch next
Watch for vendor advisories that name Brotli. They usually trail the upstream fix by days or weeks, and they are what tells you whether a specific product is exposed. Watch whether Adobe updates APSB26-73 to reflect exploitation. Watch NVD for an analysis of the Brotli and Arista records. And watch the KEV catalog itself: CISA can change the ransomware field from “Unknown” to “Known” after listing.
Sources
- CISA Known Exploited Vulnerabilities catalog and JSON feed, version 2026.10.27, checked October 27, 2026 (entries for CVE-2026-48356, CVE-2026-111497, CVE-2026-114625 and CVE-2026-110447: date added, due date, ransomware use, forensic triage)
- Adobe, “Security update available for Adobe Commerce, APSB26-73,” published July 14, 2026, last updated August 11, 2026
- Google Brotli release v1.2.1, October 21, 2026
- Arista Security Advisory 0199, October 22, 2026
- NVD entries CVE-2026-48356, CVE-2026-111497 and CVE-2026-114625
- CISA BOD 26-04, Prioritizing Security Updates Based on Risk
Related: PHP2Shell was probed before the patch, the same vendor-inventory logic for PHP, and Security and vulnerabilities, every security briefing, guide and tool in one place.