SecurityOnlineDo Son
Palo Alto confirms critical Brotli flaw affects PAN-OS
Part of the CVE-2026-111497 story · since 21 Oct
- Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution.
- Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds.
- Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds.
- Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses.
- Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications.
- Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws.
- Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software.
- Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution.
- Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption.
- Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks.
- Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw.
- Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution.
- Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. This article, 13th of 13.
Palo Alto Networks confirmed on 26 October 2026 that CVE-2026-111497, a critical Brotli decoder buffer-overflow flaw, affects PAN-OS releases 12.2, 12.1 and 11.2, as well as the Prisma Cloud Application Security Transporter Client. The advisory notes the vulnerability has a CVSS v4 score of 9.2 (Critical) and that PAN-OS 11.1 and 10.2 are not affected.
Hotfixes are provided for each affected branch: PAN-OS 12.2 requires 12.2.4-h1 or later; 12.1 requires 12.1.4-h13, 12.1.7-h11 or 12.1.10-h3 or later; and 11.2 requires 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, or 11.2.16-h1 or later. The Prisma Cloud Transporter Client is affected and should be updated to 0.2.9, alongside updates to any standalone Brotli library to 1.0.10, 1.1.1 or 1.2.1. The publication notes there is no confirmed exploitation and CISA KEV does not list CVE-2026-111497 at this time.
Attackable via a crafted Brotli-compressed stream, the flaw arises from an out-of-bounds write in the Google Brotli decoder (versions 1.0.3 through 1.2.0). An unauthenticated remote attacker can potentially corrupt decoder memory to disclose sensitive data, trigger a denial of service, or execute arbitrary code. Palo Alto’s advisory emphasises the vulnerability is in the Brotli shared library, not in PAN-OS code itself, and developers have yet to specify which PAN-OS features process Brotli data. No wild exploitation has been reported.
How the story developed
13 articles from 6 outlets since 21 Oct. Still developing; the latest report was 59 minutes ago. This was the 13th report, 5 days after the first.
- Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution.
- Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds.
- Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds.
- Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses.
- Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications.
- Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws.
- Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software.
- Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution.
- Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption.
- Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks.
- Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw.
- Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution.
- Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. This article, 13th of 13.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 13 articles as a listHide the list
- Wed 21 OctDay 01
- Node.js fixes Brotli flaw that could enable remote code execution17:54 · SecurityOnline · First report
Quiet for 2 days
Fri 23 OctDay 21- Node.js Brotli flaw enables remote code execution in Linux arm64 builds08:35 · The Hacker News
- Sat 24 OctDay 31
- Brotli Flaw Enables Code Execution in Unpatched Node.js Builds11:00 · The Hacker News
- Sun 25 OctDay 41
- OpenAI Agents Expose VM Escapes and Sandbox Weaknesses08:30 · The Hacker News
- Mon 26 OctDay 58
- Brotli flaw expands Node2Shell risk across HTTP applications01:30 · SecurityOnline
- Microsoft issues out of band .NET fixes for four flaws03:19 · SecurityOnline
- Brotli flaw triggers security updates across major software11:00 · SecurityWeek
Show 5 more from 26 Oct
- Brotli flaw exposes Python packages to remote code execution13:00 · SOCRadar
- Microsoft patches critical .NET flaw that risks memory corruption13:30 · Infosecurity
- Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News
- PHP releases rebuilt Windows packages to fix Brotli flaw18:30 · The Hacker News
- Tue 27 OctDay 61
- Palo Alto confirms critical Brotli flaw affects PAN-OS02:00 · SecurityOnline · This article, 13th of 13