PatchTheCVEBlog · 2-hour update · 2026-10-27
CVE-2026-111497 Google Brotli: exploited in the wild, how to patch
By the PatchTheCVE security team · Updated 2026-10-28 · Data from NVD, CISA KEV, EPSS and vendor advisories
Critical severity (CVSS 9.2), exploited in the wild, remotely exploitable, no login needed. Recommended action: apply the vendor mitigation.
On 27 October 2026, 32 new CVEs were published that we track: 2 critical, 2 already exploited in the wild (CISA KEV) and 3 with a fix or vendor patch available. Each one is ranked by severity, exploitation signals and how easy it is to reach, so you can patch the right ones first.
Key takeaways
- Most urgent: CVE-2026-111497 (Google Brotli): apply the vendor mitigation.
- 2 exploited in the wild (CISA KEV): patch these before anything else.
- 4 of the top 8 can be attacked over the network without a login.
- 3 of 32 new CVEs already have a fix or vendor patch.
- Most affected vendors: golang.org x net, microsoft.
What happened in this 2-hour window: the most serious item is CVE-2026-111497 in Brotli (critical, CVSS 9.2, priority 90/100). Recommended action: apply the vendor mitigation. 2 new CVEs from the list below are already being exploited (CVE-2026-111497, CVE-2026-48356), so those go first. 4 of the 8 top items can be attacked remotely without a login. Most affected: golang.org x net (2), microsoft (1). 3 of 32 new CVEs already have a fix or vendor patch; for the other 29, follow the downgrade or mitigation steps until one ships.
Patch these first
CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerability
- Risk: Critical (CVSS 9.2), priority 90/100 (patch now), published 22 October 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-11-10; 55.5% chance of exploitation in the next 30 days (EPSS); attackable over the network without a login
- Affected: Google Brotli
- Patch ID: RHSA-2026:10767, RHSA-2026:19131, RHSA-2026:90449
- What to do: apply the vendor mitigation for Google Brotli
Why it ranks here: critical severity; epss top 1%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD
CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
- Risk: Critical (CVSS 9.3), priority 82/100 (patch now), published 14 July 2026
- Exploitation: exploited in the wild (CISA KEV), federal due date 2026-11-10; 30.6% chance of exploitation in the next 30 days (EPSS)
- Affected: adobe commerce (>= 1.6.0 and < 1.21.0)
- Fixed in: 1.21.0
- What to do: downgrade to a release before 2.4.4 until a fix ships for adobe commerce
Why it ranks here: critical severity; epss top 2%: very likely to be exploited; exploited in the wild (cisa kev).
References: NVD · Vendor Advisory
CVE-2026-116692: MLflow is an open source AI engineering platform for agents, large language models, and machine learning model
- Risk: Critical (CVSS 9.8), priority 39/100 (patch this month), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-112352: Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated
- Risk: Critical (CVSS 9.1), priority 37/100 (patch this month), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: critical severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-85898: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
- Risk: High (CVSS 8.8), priority 36/100 (routine), published 27 October 2026
- What to do: apply the vendor mitigation
Why it ranks here: high severity; on your watchlist.
References: NVD
CVE-2026-83831: Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Risk: High (CVSS 8.8), priority 36/100 (routine), published 27 October 2026
- What to do: apply the vendor mitigation
Why it ranks here: high severity; on your watchlist.
References: NVD
CVE-2026-116693: dd-trace is the Datadog APM client for Node.js
- Risk: High (CVSS 8.7), priority 35/100 (routine), published 27 October 2026
- Exploitation: attackable over the network without a login
- What to do: apply the vendor mitigation
Why it ranks here: high severity; remotely exploitable, no login, no user action.
References: NVD
CVE-2026-62765: Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
- Risk: High (CVSS 7.5), priority 31/100 (routine), published 27 October 2026
- Affected: microsoft microsoft edge chromium-based (>= 1.0.0.0 and < 149.0.4022.62)
- Fixed in: 149.0.4022.62
- What to do: upgrade to 149.0.4022.62 for microsoft microsoft edge chromium-based
Why it ranks here: high severity; on your watchlist.
References: NVD · Vendor Advisory, Patch
Most affected vendors
- golang.org x net: 2 new CVEs
- microsoft: 1 new CVE
How to act on this list
- Start with anything marked exploited or patch now.
- Check what you run: see how to check a version and patch it on Linux, Windows, pip and npm.
- Prefer the vendor or distro fix. If none exists, read when to downgrade and when to mitigate.
- Verify afterwards. Distros often fix a flaw without changing the upstream version, here is how to confirm.
FAQ
What is the most serious vulnerability published on 27 October 2026?
CVE-2026-111497 (Google Brotli Unchecked Return Value Vulnerability) ranks highest, with a priority score of 90/100. Recommended action: apply the vendor mitigation.
Are any of the new CVEs exploited in the wild?
Yes, 2 of the new CVEs appear on the CISA Known Exploited Vulnerabilities list. Patch those first.
Should I downgrade if there is no fix yet?
Only when an older release is confirmed unaffected and the package is not a core system component. Downgrades can break dependent software, so test first and hold the package until a fix ships.
Sources
- NIST National Vulnerability Database: CVE details and affected versions
- CVE Program: official CVE records
- CISA Known Exploited Vulnerabilities catalog: exploitation in the wild
- FIRST EPSS: exploit probability
- Distribution and vendor advisories linked under each item.