Palo Alto says Brotli flaw can hit some PAN-OS firewalls (CVE-2026-111497)
Original title: Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds
The CVSS 9.2 decoder bug needs Brotli inspection plus decryption; no exploitation is known, and hotfixes are only estimated.
Palo Alto Networks confirmed CVE-2026-111497, a critical flaw in Google’s Brotli decoder, affects some PAN-OS firewalls and the Prisma Cloud Application Security Transporter Client. A crafted compressed stream can trigger an out-of-bounds write that may corrupt memory, expose data, crash a service, or potentially run code without authentication. Exposure on PA-Series and VM-Series requires Brotli inspection and TLS/SSL decryption; the management interface is not affected. The company knows of no malicious exploitation and advises disabling inspection until estimated hotfixes.
Unconfirmed: Palo Alto’s investigation of products and cloud services is ongoing, and hotfix availability dates are estimates.
- Advisory dated October 26, 2026; CVSS 9.2 but moderate response urgency.
- Brotli inspection is off by default and unsupported before PAN-OS 11.2.4.
- PAN-OS 11.1 and 10.2, Panorama virtual appliances, and M-Series are unaffected.
- Fixed Brotli releases are 1.0.10, 1.1.1, and 1.2.1.
- Transporter Client should move to 0.2.9 or later; Threat ID 97686 is only partial coverage.
Impact: Unauthenticated memory corruption, data exposure, crash, or code execution
| Product | Affected | Fixed in |
|---|---|---|
| Palo Alto Networks PAN-OS | 11.2.4 and later with Brotli inspection and TLS/SSL decryption | 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, 11.2.16-h1 |
| Palo Alto Networks Prisma Cloud Application Security Transporter Client | — | 0.2.9 |
| Google Brotli | — | 1.0.10, 1.1.1, 1.2.1 |
- 1.Disable Brotli inspection and confirm the setting shows Enabled: no.
- 2.Upgrade Prisma Cloud Application Security Transporter Client to 0.2.9 or later.
- 3.Track the matching PAN-OS hotfix; listed October 27–30 dates are estimates.
- CVEs
- CVE-2026-111497
- Vendors
- Palo Alto NetworksGoogle
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at cybersecuritynews.com
Palo Alto Networks has confirmed that a critical Brotli vulnerability affects some PAN-OS firewall deployments and its Prisma Cloud Application Security Transporter Client. Tracked as CVE-2026-111497, the flaw could let an attacker corrupt memory, expose sensitive data, crash a service, or potentially run code without authentication. The company published its advisory on October 26, 2026.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.