CISA KEV Alert: CVE-2026-48356 (Adobe Commerce/Magento File Upload) and CVE-2026-111497 (Google Brotli) — Detection and Remediation Guide

On October 27, 2026, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild:

• CVE-2026-48356 — Adobe Commerce and Magento Open Source: Unrestricted Upload of File with Dangerous Type
• CVE-2026-111497 — Google Brotli: Unchecked Return Value

A KEV listing is not a theoretical advisory. It is CISA's confirmation that threat actors are exploiting these flaws against real targets right now. For Federal Civilian Executive Branch (FCEB) agencies, Binding Operational Directive (BOD) 26-04 — Prioritizing Security Updates Based on Risk — mandates rapid remediation of KEV-listed vulnerabilities. For everyone else, the KEV catalog remains the single most reliable prioritization signal in vulnerability management: if it is on the list, assume exploitation attempts against your exposed assets are already underway or imminent.

The e-commerce angle here deserves emphasis. Adobe Commerce and Magento storefronts sit directly on the internet, process payment data (putting them squarely in PCI-DSS scope), and historically attract both financially motivated groups skimming card data and initial access brokers staging web shells for resale. An unrestricted file upload flaw in this stack is a direct path to remote code execution on the web tier.

Technical Analysis

CVE-2026-48356 — Adobe Commerce / Magento Unrestricted Upload of File with Dangerous Type

Vulnerability class: CWE-434 (Unrestricted Upload of File with Dangerous Type)

Affected products: Adobe Commerce and Magento Open Source deployments. Defenders should consult the official Adobe security bulletin (apsb) for the exact affected version ranges and fixed builds applicable to their release train — Adobe typically ships these as versioned security patches or hotfixes for supported Commerce and Open Source branches.

How the vulnerability works (defender's perspective):

Unrestricted file upload vulnerabilities in Magento are well understood because they follow a repeatable exploitation pattern:

1. Attacker identifies an upload endpoint that fails to properly validate file type, extension, MIME type, or content — or that can be bypassed via double extensions (shell.php.jpg), case manipulation, null-byte tricks, or missing server-side validation.
2. A malicious file — typically a PHP web shell — is uploaded into a web-accessible directory. In Magento, the most dangerous landing zones are pub/media/, media/, and any directory served directly by the web server where PHP execution is not explicitly disabled.
3. The attacker requests the uploaded file over HTTP, causing the PHP interpreter to execute it. From that point, the attacker has code execution as the web server user (typically www-data, apache, or nginx), enabling:
   • Deployment of card skimmers (Magecart-style) injected into checkout flows
   • Theft of app/etc/env.php containing database credentials and the encryption key
   • Lateral movement, persistence via cron jobs or additional admin users in the admin_user table
   • Ransomware staging or resale of access

Why this is critical in Magento specifically: A hardened Magento deployment configures nginx/Apache to deny PHP execution in media/ and other upload directories. This flaw matters because it bypasses the upload-time validation layer — and far too many real-world deployments have drifted from the hardened baseline, leaving pub/media executable.

Exploitation status: Confirmed active exploitation. Listed in CISA KEV as of 2026-10-27. Treat exposed Magento instances as actively targeted.

CVE-2026-111497 — Google Brotli Unchecked Return Value

Vulnerability class: CWE-252 (Unchecked Return Value)

Affected products: Google Brotli compression library. Brotli is not a standalone product most teams inventory — it is an embedded dependency. It ships inside web servers (nginx with the Brotli module, Apache mod_brotli), CDNs, reverse proxies, browsers, curl, Node.js, and countless application stacks that perform Brotli compression/decompression of HTTP content.

How the vulnerability works (defender's perspective):

An unchecked return value flaw means the library fails to verify the result of a critical operation — in a compression library, this typically translates into error conditions during compression/decompression being silently ignored. Depending on the surrounding code, that can yield corrupted output, out-of-bounds reads/writes downstream, or application states the caller never anticipated. For defenders, the key takeaways are:

• The attack surface is anywhere Brotli processes attacker-controlled input — most notably decompression of request bodies or compression of responses on internet-facing web infrastructure.
• Remediation is an inventory and dependency-upgrade problem, not a single-server patch. You must find every place Brotli is linked — system packages (libbrotli), nginx/Apache modules, container base images, language runtime bundles — and upgrade each to the fixed version per Google's advisory.
• Exploitation in the wild means CISA has evidence attackers are reaching this code path reliably enough to weaponize it. Do not deprioritize it because it is a "library bug."

Exploitation status: Confirmed active exploitation. Listed in CISA KEV as of 2026-10-27.

Detection & Response

The detections below focus on the highest-fidelity post-exploitation behaviors: web shells executing out of Magento media directories, web server processes spawning shells, and anomalous upload requests. For the Brotli flaw, detection at the endpoint is low-fidelity; the correct defensive play is asset/dependency inventory and network monitoring for anomalous behavior on Brotli-enabled services — the VQL hunt below covers both angles.

Sigma Rules

---
title: PHP File Created in Magento Media or Upload Directory
id: 8f2c1a44-6b7d-4e19-9c3a-2d5e7f901234
status: experimental
description: Detects creation of PHP or other executable script files in Magento media/upload directories, a hallmark of web shell deployment via unrestricted file upload flaws such as CVE-2026-48356.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/27
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_creation
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/pub/media/'
      - '/media/catalog/'
      - '/media/wysiwyg/'
      - '/var/www/html/media/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Rare legitimate CMS extension installs writing PHP into media paths (should be investigated regardless)
level: high
---
title: Web Server Process Spawning Shell or System Utility
id: 3b9e7d21-4c5a-4f82-a1d6-8e9f0b2c3d4e
status: experimental
description: Detects PHP-FPM, Apache, or nginx worker processes spawning command shells or system utilities, consistent with post-exploitation activity following web shell deployment on Magento/Adobe Commerce servers.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/27
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Magento cron and indexer jobs executing system commands (tune by known cron parent chain)
  - Legitimate image-processing pipelines invoking system binaries
level: high
---
title: Suspicious Upload Request to Magento Endpoint Followed by Executable Retrieval
id: 5c1d8f33-2a4b-4e96-b7c2-9d0e1f2a3b4c
status: experimental
description: Detects HTTP POST requests to Magento upload or WYSIWYG endpoints, and requests for script file extensions under media paths, patterns consistent with CVE-2026-48356 exploitation attempts.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/27
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_upload:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/admin/cms/wysiwyg/directive'
      - '/wysiwyg/'
      - '/uploader'
      - '/upload'
      - '/rest/V1/'
  selection_exec:
    cs-method: 'GET'
    cs-uri-stem|contains:
      - '/media/'
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin content uploads (correlate with authenticated admin source IPs)
level: medium

KQL — Microsoft Sentinel / Defender

The following query hunts for web-server child process execution on Linux Magento hosts via Syslog/CEF ingestion, plus suspicious requests to Magento upload and media paths in proxy/WAF logs. Run it across the last 14 days and pivot on any host with hits in both legs — that correlation is a strong compromise indicator.

// Hunt 1: Web server processes spawning shells/utilities (Syslog ingestion from Magento hosts)
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("php-fpm", "php-fpm8.1", "php-fpm8.2", "php-fpm8.3", "apache2", "httpd", "nginx")
   or SyslogMessage has_any ("php-fpm", "apache2", "nginx")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "/usr/bin/curl", "/usr/bin/wget", "ncat", "netcat", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 2: Requests for executable files under Magento media paths in WAF/proxy logs (CEF)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has_any ("/media/", "/pub/media/", "/pub/static/")
| where RequestURL has_any (".php", ".phtml", ".phar")
| summarize RequestCount = count(), DistinctSources = dcount(SourceIP) by RequestURL, DestinationHostName, SourceIP, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;

// Hunt 3: POST flood to Magento upload endpoints (potential CVE-2026-48356 probing)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestMethod =~ "POST"
| where RequestURL has_any ("uploader", "upload", "wysiwyg", "/rest/V1/")
| summarize Hits = count(), DistinctURIs = dcount(RequestURL) by SourceIP, DestinationHostName, bin(TimeGenerated, 10m)
| where Hits > 25
| order by Hits desc

Velociraptor VQL

This hunt artifact identifies recently created script files inside Magento media/upload directories across your Linux web tier — the single highest-value forensic check after a KEV listing of an unrestricted-upload flaw. Deploy it as a hunt across all servers hosting Magento/Adobe Commerce.

-- Hunt for web shells and recently dropped scripts in Magento media directories
-- Deploy across all Adobe Commerce / Magento web servers
SELECT FullPath,
       Size,
       Mtime,
       Ctime,
       Mode,
       hash(path=FullPath) AS FileHash
FROM glob(globs=[
  '/var/www/**/pub/media/**/*.php',
  '/var/www/**/pub/media/**/*.phtml',
  '/var/www/**/pub/media/**/*.phar',
  '/var/www/**/media/**/*.php',
  '/srv/**/pub/media/**/*.php',
  '/home/**/pub/media/**/*.php'
])
WHERE Mtime > now() - 2592000
ORDER BY Mtime DESC

For the Brotli exposure, run this companion artifact to inventory which installed packages and loaded modules carry the vulnerable library, giving you the remediation target list:

-- Inventory Brotli library presence and loaded modules on Linux hosts
SELECT FullPath,
       Size,
       Mtime
FROM glob(globs=[
  '/usr/lib/**/libbrotli*.so*',
  '/usr/lib/x86_64-linux-gnu/libbrotli*.so*',
  '/lib/**/libbrotli*.so*',
  '/usr/local/lib/libbrotli*.so*',
  '/etc/nginx/modules-enabled/*brotli*',
  '/usr/lib/apache2/modules/*brotli*'
])

Remediation

Immediate Actions (24–48 Hours)

1. Identify every exposed asset. Enumerate all Adobe Commerce / Magento instances and all services linking Brotli (nginx/Apache Brotli modules, reverse proxies, containers, Node.js runtimes). Internet-facing assets are priority one. Use your external attack surface management tooling, not just your CMDB — KEV-listed upload flaws are exactly what forgotten dev/staging storefronts get popped with.

2. Apply vendor patches. Deploy the Adobe security patch for CVE-2026-48356 per the official Adobe Product Security Incident Response Team (PSIRT) bulletin at https://helpx.adobe.com/security.html, and upgrade Brotli to the fixed release per Google's advisory and your distribution's security channel (libbrotli package updates for Debian/Ubuntu/RHEL; module rebuilds for nginx/Apache). Verify exact fixed version numbers against the vendor advisories before scheduling maintenance windows.

3. Meet BOD 26-04 obligations. FCEB agencies must remediate both CVEs within the deadlines specified in the CISA KEV catalog entry and BOD 26-04. Private-sector organizations should adopt the same deadlines as internal SLAs — they are calibrated to observed exploitation tempo.

Hardening (If Patching Must Wait)

Deploy this verification and hardening script on Magento web servers to (a) disable PHP execution in media directories at the nginx layer, (b) audit for existing web shells, and (c) report Brotli library versions for upgrade tracking:

#!/bin/bash
# CVE-2026-48356 / CVE-2026-111497 — Magento hardening and exposure audit
# Run as root on each Magento/Adobe Commerce web server

REPORT="/root/kev_audit_$(hostname)_$(date +%Y%m%d).txt"
echo "=== KEV Audit: $(hostname) $(date) ===" | tee "$REPORT"

echo -e "\n[1] Existing script files under media directories (potential web shells):" | tee -a "$REPORT"
find /var/www /srv /home -type d \( -name "media" -o -name "wysiwyg" \) 2>/dev/null | while read -r dir; do
  find "$dir" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -mtime -60 -ls 2>/dev/null | tee -a "$REPORT"
done

echo -e "\n[2] Installed Brotli library packages (CVE-2026-111497 exposure):" | tee -a "$REPORT"
if command -v dpkg >/dev/null 2>&1; then
  dpkg -l | grep -i brotli | tee -a "$REPORT"
elif command -v rpm >/dev/null 2>&1; then
  rpm -qa | grep -i brotli | tee -a "$REPORT"
fi
ldconfig -p 2>/dev/null | grep -i brotli | tee -a "$REPORT"

echo -e "\n[3] nginx Brotli modules loaded:" | tee -a "$REPORT"
nginx -V 2>&1 | tr ' ' '\n' | grep -i brotli | tee -a "$REPORT"
ls /etc/nginx/modules-enabled/ 2>/dev/null | grep -i brotli | tee -a "$REPORT"

echo -e "\n[4] Applying PHP execution block for media directories (nginx include):" | tee -a "$REPORT"
cat > /etc/nginx/conf.d/magento_media_deny_php.conf <<'EOF'
# Block PHP execution in Magento upload/media directories - CVE-2026-48356 mitigation
location ~* ^/(pub/)?media/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
}
location ~* ^/(pub/)?static/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
}
EOF
nginx -t 2>&1 | tee -a "$REPORT" && systemctl reload nginx && echo "nginx reloaded with media PHP block." | tee -a "$REPORT"

echo -e "\n[5] Web server child process audit (last 24h, if auditd present):" | tee -a "$REPORT"
ausearch -ts recent -k execve 2>/dev/null | grep -E "php-fpm|apache2|nginx" | grep -E "/bin/(sh|bash)|curl|wget|nc " | tee -a "$REPORT"

echo -e "\nAudit complete. Review $REPORT and remediate findings." | tee -a "$REPORT"

Additional hardening measures:

• Restrict the Magento admin panel behind VPN or IP allowlisting; unrestricted-upload exploitation is dramatically easier with admin-adjacent endpoint access.
• Deploy or tune WAF rules to block executable file signatures in multipart uploads and to alert on requests for .php under /media/.
• Rotate app/etc/env.php credentials and the Magento encryption key on any host where the audit above finds suspicious script files — assume database and payment-layer compromise.
• For Brotli: patch base container images and rebuild; check Node.js and curl versions bundled in application images, as they carry their own Brotli linkage.
• Verify backups and IR readiness for e-commerce infrastructure. Active exploitation of a storefront stack means your incident response runbook for web shell eradication and Magecart-style skimmer forensics should be reviewed this week, not after an event.

Validation

After patching, confirm remediation with authenticated vulnerability scans flagged specifically for CVE-2026-48356 and CVE-2026-111497, and re-run the VQL hunts above to establish a clean baseline. Monitor for 30 days minimum — access obtained before patching frequently persists after it.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub