Daily brief 2026-11-04: Adobe Commerce and Magento and what businesses should patch

CVE-2026-48356 (Adobe Commerce and Magento): Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability. Severity CRITICAL, CVSS 9.3, EPSS 44.6%, listed in CISA KEV (exploited in the wild).

CVE-2026-97229 (GitLab Community Edition and Enterprise Edition): GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability. Severity CRITICAL, CVSS 10, EPSS 27.7%, listed in CISA KEV (exploited in the wild).

CVE-2026-76418 (Cisco Secure Firewall ASA Software and Cisco Secure FTD Software): Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability. Severity HIGH, CVSS 8.6, EPSS 0.8%, listed in CISA KEV (exploited in the wild).

CVE-2026-119977 (WordPress Core): WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability. Severity HIGH, CVSS 8.1, EPSS 0.6%, listed in CISA KEV (exploited in the wild).

CVE-2026-112816 (CVE-2026-112816): Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.2. Severity CRITICAL, CVSS 10, EPSS 0.3%.

CVE-2024-10441 (synology beestation os): Improper encoding or escaping of output vulnerability in the system plugin daemon in Synol. Severity CRITICAL, CVSS 9.8, EPSS 1.3%.

Cisco networking: CVE-2026-76418. See the Business Apps page for what to ask your provider.

WordPress & websites: CVE-2026-48356, CVE-2026-119977, CVE-2024-10441. See the Business Apps page for what to ask your provider.

Prioritize anything in CISA KEV and anything internet-facing (VPNs, firewalls, web servers, remote-support tools). Confirm patch status across every client tenant, and kill active sessions after patching gateway appliances.

CVE-2026-48356: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-97229: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-76418: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-48356 affects Adobe Commerce and Magento. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

CVE-2026-119977 affects WordPress Core. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

Ask your IT provider which of these products you run, and get written confirmation they are patched or mitigated.

Enforce MFA, keep tested offline backups, and make sure remote access is not exposed without protection.