CISA KEV catalog as of November 9, 2026 (1,769 entries, catalog version 2026.11.06); Microsoft emergency Brotli fix released October 25, 2026
Two 9-Point Flaws Come Due Tomorrow: Adobe Commerce and Brotli Head a KEV Week With Five Deadlines in Eleven Days
The federal patch clock, not the severity score, sets this week. Two Known Exploited Vulnerabilities catalog entries carry a remediation deadline of tomorrow, November 10: CVE-2026-48356, an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento, scored 9.3, and CVE-2026-111497, an unchecked return value flaw in the Google Brotli decoder, scored 9.2. The Brotli flaw is the one that traveled under three names in October, Broccoli2Shell, Node2Shell and HTTP2Shell, and it drew an emergency Microsoft fix on October 25 covering the Brotli libraries in .NET 8, 9 and 10 and the .NET 11 release candidate; proof-of-concept code was already public when that forecast was written. A third deadline lands Wednesday, November 11: CVE-2026-41709, the VMware ESX insufficient logging flaw, scored only 2.7, which sits in the catalog because CISA holds exploitation evidence for it, the standing reminder that a KEV listing is an exploitation finding and not a severity ranking. Three more deadlines follow in the same window: the Ivanti Connect Secure predictable filename flaw (CVE-2026-118527, 4.3) on November 13, the Apple WebKit pointer authentication bypass (CVE-2024-27834, 5.5) on November 18, and the SonicWall SonicOS SAML bypass (CVE-2026-19868, 7.5) on November 20. The catalog itself now holds 1,769 entries as of November 9, with 285 added in 2026 and 361, about 20 percent, marked as known to be used in ransomware campaigns. The pace is structural: since June 10, 2026, 79 percent of new entries have carried due dates of three days or less. Brotli deserves the extra sentence, because a compression decoder does not live in one product; it ships inside browsers, servers, runtimes and embedded libraries, so the patch question is which copies of it you run, not whether you run it.
Executives
Five federal deadlines land in the next eleven days, and two of them land tomorrow. The executive content is the ordering: the catalog deadlines, not vendor severity marketing, are the defensible priority list, and one of this week entries is scored 2.7, which a severity-sorted queue would bury. Ask for the deadline view of your patch queue, with the Adobe Commerce and Brotli items closed or formally excepted by tomorrow, and ask specifically where Brotli ships inside other products you buy, because that copy is the one nobody owns.
CIO / CISO
Work the dates in order: Adobe Commerce and Brotli by November 10, VMware ESX logging by November 11, Ivanti Connect Secure by November 13, then Apple and SonicWall on November 18 and 20. For Brotli, inventory the decoder as a component, in .NET runtimes, in server and proxy builds, and in vendor appliances, and record which copies took the October 25 emergency fix and which are waiting on a vendor. Keep the ESX item in the same priority band despite its 2.7 score: KEV membership is the exploitation evidence, and a logging flaw is precisely the gap that hides the follow-on activity.
Engineers
Patch and then prove it. For Adobe Commerce and Magento, apply the vendor fix and review upload paths and recent file writes, since the flaw class is arbitrary file upload reaching code execution. For Brotli, update every decoder copy you can enumerate, restart the services that loaded the old library so the fixed code is what is actually running, and note the copies you cannot enumerate as an open finding rather than an assumption. For the ESX logging flaw, preserve what logs exist before the fix and review the gap period, because the remediation does not reconstruct the record the flaw may have thinned.
Everyone (non-IT)
Nothing here asks home users for a special step beyond the standing one: let your browser, phone and computer take their updates this week, since the Brotli decoder ships inside everyday software and the fixes travel with those updates. If a website you run uses Magento or Adobe Commerce, tomorrow deadline is yours as well, and the update belongs at the top of the week list.