CISA KEV entry for the CVE-2026-71362 incorrect authorization flaw in Adobe Commerce and Magento shows date added 2026-09-24. Federal agencies must apply mitigations by 2026-09-27 under BOD 26-04 rules.
CVE-2026-71362 allows unauthorized access without user interaction.
Stakeholders must assess internet exposure.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
CISA added Ivanti Connect Secure flaws CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on October 30. Ivanti says attackers chained them with CVE-2026-104935. Fixes are in 25.1.1.3 and 22.8R2.6.
Adobe and Disney announced a multi-year alliance on November 9, including custom generative models in Adobe Firefly Foundry trained on Disney properties.
CISA has added an exploited FreeSWITCH flaw, CVE-2026-116779, to its known-exploited catalog, with a due date of November 12.
A critical heap-based buffer overflow affects the D-Link DIR-878 on firmware 1.20B05 through the HNAP Handler. The flaw allows remote unauthenticated attacks and has a public exploit available.
Iris Plaza says personal data stored for about 7.7 million people in an outside cloud service may have been viewed or taken, and the actual count is still under investigation.
