Magento / Adobe Commerce · week of 26 Oct 2026
Magento / Adobe Commerce security note
Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
CVE-2026-111497 — Patch now
Out-of-Bounds Write in Google Brotli Decoder
Fixed in 22.23.4 · 3 other ranges on the advisory
CVE-2026-48356 — Patch now
Adobe commerce Unrestricted Upload of File with Dangerous Type
Seen in 2.4.4
What we still do not know
Every changed record in this note has a version range.
Share this note
Magento / Adobe Commerce security note, week of 26 Oct 2026: 2 records have a version a customer can check, and 0 still do not. https://zerodayfindings.com/technologies/magento/notes/2026-W44