US cybersecurity agency CISA has added two vulnerabilities affecting Adobe Commerce, Magento and Google’s Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalogue, indicating there is evidence of active exploitation in the wild. The development is particularly relevant for businesses operating e-commerce stores, customer portals or digital sales systems built on Adobe Commerce or Magento.

While the source report points to ongoing attacks affecting online stores, the most important business takeaway is straightforward: a vulnerability has moved from being a technical risk to an actively exploited operational threat. For companies relying on affected platforms, that raises the priority of patching, monitoring and compromise assessment.

What happened

CISA added two vulnerabilities to its KEV catalogue after identifying evidence of active exploitation. The affected technologies include Adobe Commerce and Magento, as well as Google’s Brotli library.

A listing in the KEV catalogue does not create new legal obligations for most private-sector European businesses by itself, but it is widely treated as a high-priority warning. In practice, KEV inclusion means security teams should assume attackers are already using the issue and that delayed remediation increases exposure.

The source indicates that attacks have affected online stores. Where businesses use Adobe Commerce or Magento directly, the risk is more immediate. Where they depend on hosting providers, systems integrators or third-party agencies to manage those platforms, the issue still matters because the vulnerable component may sit in a supplier-managed environment.

Why it matters for European businesses

Adobe Commerce and Magento are used for revenue-generating websites, customer accounts, order workflows and integrations with payment, inventory and CRM systems. A successful compromise can therefore affect more than website availability. It may also create risks around customer data, administrator access, malicious code injection, payment-related workflows and brand trust.

For European companies, the business impact can be significant if an incident leads to store downtime, unauthorised changes to checkout journeys, data exposure or follow-on attacks against connected systems. Even when the initial vulnerability is in a web application layer, the commercial consequences often extend into marketing performance, fulfilment operations and customer service.

The inclusion of a Brotli-related issue also matters beyond a single e-commerce platform. Brotli is a compression technology used in web delivery and software environments. Businesses may not recognise it as a standalone dependency, which makes software inventory and third-party risk management more important. If a vulnerable library is embedded in a broader stack, exposure may not be obvious from a surface-level platform check.

Who may be affected

• E-commerce businesses running Adobe Commerce or Magento storefronts
• SMEs that rely on agencies, hosting companies or external developers to maintain their online shops
• IT and security teams responsible for patching internet-facing business applications
• Marketing and digital teams whose campaigns depend on store uptime, landing pages and conversion tracking
• Regulated or data-sensitive businesses where a web compromise could create wider privacy, contractual or incident-reporting implications

Companies can also be indirectly affected if a subsidiary brand, regional webshop or franchise-operated store uses the vulnerable software without central oversight.

What companies should consider

• Identify exposure quickly. Confirm whether your organisation uses Adobe Commerce, Magento or products that include the affected Brotli component.
• Prioritise remediation. If vendor patches or mitigation guidance are available, treat them as urgent because the vulnerabilities are reportedly being exploited.
• Check managed suppliers. Ask hosting providers, e-commerce agencies and managed service partners whether your environments are affected and what actions have been taken.
• Review signs of compromise. Look for unexpected administrator accounts, unauthorised code changes, suspicious outbound connections, unusual web server activity and checkout or content modifications.
• Strengthen access controls. Review admin panel exposure, enforce strong authentication and limit privileged access to essential users.
• Validate recovery readiness. Ensure backups, restoration procedures and incident contacts are current in case remediation uncovers a broader compromise.
• Assess connected systems. If an online store integrates with CRM, ERP, payment or marketing tools, investigate whether credentials or trusted connections could have been affected.

For European businesses, the key lesson is not only to patch the named systems, but also to treat internet-facing commerce infrastructure as a business-critical security priority. Active exploitation against e-commerce software can quickly become a sales, operations and customer trust issue rather than a purely technical one.