Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Arista patches two flaws that risk remote code execution

Part of the CVE-2026-111497 story · since 21 Oct

Developinglatest 56 minutes ago22 articles8 outlets
21 Oct · SecurityOnline first28 Oct31 OctNowThis article22nd of 22
  • Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds. Cites a CVE in CISA KEV.
  • Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 23:00 UTC. SecurityOnline. Sweet Security offers free protection against HTTP2Shell. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 01:00 UTC. SecurityOnline. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:00 UTC. SecurityOnline. Broadcom warns of critical VMware SDDC Manager flaw. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:01 UTC. The Hacker News. CISA Adds Two Actively Exploited Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 09:30 UTC. SecurityWeek. Researchers report exploitation attempts against Brotli flaw. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 11:30 UTC. Security Affairs, its first report on the story. CISA adds Brotli and Magento flaws to its exploited list. Cites a CVE in CISA KEV.
  • Mon 2 Nov, 03:31 UTC. SecurityOnline. Brotli flaw prompts updates across runtimes and software. Cites a CVE in CISA KEV.
  • Tue 3 Nov, 03:30 UTC. SecurityOnline. Arista patches two flaws that risk remote code execution. Cites a CVE in CISA KEV. This article, 22nd of 22.

Arista Networks has issued patches for two critical vulnerabilities in its core networking gear, with fixes released on 2 November 2026. The flaws enable remote code execution (RCE) and are rated highly, with CVSSv3 scores up to 9.8. The two CVEs are CVE-2026-111497, described as an out-of-bounds write in Google Brotli (HTTP2Shell), and CVE-2026-98432, a Linux kernel IPv4 use-after-free flaw. The article notes one of the two flaws has a confirmed exploitation vector so far, while the other has not been exploited publicly to date.

Affected products and patches are detailed in Arista advisories. CVE-2026-111497 impacts the VeloCloud Orchestrator across trains 6.4.2, 6.1.3 and 5.2.3; Arista states there is no mitigation other than upgrading to 6.4.2[.]14, 6.1.3[.]12 or 5.2.3[.]20. CVE-2026-98432 affects Linux kernel IPv4 use in NDR devices by default, with exploitation requiring multipath TCP (MPTCP) to be enabled in the kernel; the NDR platform on version 5.4.11 and older is noted as affected.

The article also lists OpenConfig Wi‑Fi Access Points as affected by CVE-2026-98432, alongside EOS switches and CloudVision services as unaffected. Arista reports no active exploitation in customer networks at present, and no public exploit code is known for either vulnerability.

Patch and mitigation steps are straightforward in the article: upgrade VeloCloud Orchestrator to 6.4.2.14, 6.1.3.12 or 5.2.3.20; for NDR devices, disable MPTCP where feasible and seek assistance for manual fixes on air-gapped sites. The vendor’s advisories emphasise the urgency of updating given the remote nature of the flaws and the high severity scores.

How the story developed

All 22 articles
Developinglatest 56 minutes ago22 articles8 outlets

22 articles from 8 outlets since 21 Oct. Picked up again on 2 Nov after 5 days quiet. This was the 22nd report, 12 days after the first.

Now21 Oct2324252627282 NovFirst reportSecurityOnline · 21 Oct, 17:54This article22nd of 22 · day 13CISA alert27 Oct, 20:01 · official
  • Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds. Cites a CVE in CISA KEV.
  • Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 23:00 UTC. SecurityOnline. Sweet Security offers free protection against HTTP2Shell. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 01:00 UTC. SecurityOnline. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:00 UTC. SecurityOnline. Broadcom warns of critical VMware SDDC Manager flaw. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:01 UTC. The Hacker News. CISA Adds Two Actively Exploited Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 09:30 UTC. SecurityWeek. Researchers report exploitation attempts against Brotli flaw. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 11:30 UTC. Security Affairs, its first report on the story. CISA adds Brotli and Magento flaws to its exploited list. Cites a CVE in CISA KEV.
  • Mon 2 Nov, 03:31 UTC. SecurityOnline. Brotli flaw prompts updates across runtimes and software. Cites a CVE in CISA KEV.
  • Tue 3 Nov, 03:30 UTC. SecurityOnline. Arista patches two flaws that risk remote code execution. Cites a CVE in CISA KEV. This article, 22nd of 22.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 22 articles as a list
  1. Wed 21 OctDay 01
    1. Node.js fixes Brotli flaw that could enable remote code execution17:54 · SecurityOnline · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 2 days

    Fri 23 OctDay 21
    1. Node.js Brotli flaw enables remote code execution in Linux arm64 builds08:35 · The Hacker News · Known exploited CVE
  3. Sat 24 OctDay 31
    1. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds11:00 · The Hacker News · Known exploited CVE
  4. Sun 25 OctDay 41
    1. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses08:30 · The Hacker News · Known exploited CVE
  5. Mon 26 OctDay 58
    1. Brotli flaw expands Node2Shell risk across HTTP applications01:30 · SecurityOnline · Known exploited CVE
    2. Microsoft issues out of band .NET fixes for four flaws03:19 · SecurityOnline · Known exploited CVE
    3. Brotli flaw triggers security updates across major software11:00 · SecurityWeek · Known exploited CVE
    Show 5 more from 26 Oct
    1. Brotli flaw exposes Python packages to remote code execution13:00 · SOCRadar · Known exploited CVE
    2. Microsoft patches critical .NET flaw that risks memory corruption13:30 · Infosecurity · Known exploited CVE
    3. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News · Known exploited CVE
    4. PHP releases rebuilt Windows packages to fix Brotli flaw18:30 · The Hacker News · Known exploited CVE
    5. Node.js Brotli flaw could expose memory or enable remote code execution19:00 · Rapid7 · Known exploited CVE
  6. Tue 27 OctDay 63
    1. Palo Alto confirms critical Brotli flaw affects PAN-OS02:00 · SecurityOnline · Known exploited CVE
    2. CISA adds exploited Google Brotli flaw to KEV catalogue20:01 · CISA · official · CISA alert · Known exploited CVE
    3. Sweet Security offers free protection against HTTP2Shell23:00 · SecurityOnline · Known exploited CVE
  7. Wed 28 OctDay 75
    1. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog01:00 · SecurityOnline · Known exploited CVE
    2. Broadcom warns of critical VMware SDDC Manager flaw08:00 · SecurityOnline · Known exploited CVE
    3. CISA Adds Two Actively Exploited Flaws to KEV Catalog08:01 · The Hacker News · Known exploited CVE
    Show 2 more from 28 Oct
    1. Researchers report exploitation attempts against Brotli flaw09:30 · SecurityWeek · Known exploited CVE
    2. CISA adds Brotli and Magento flaws to its exploited list11:30 · Security Affairs · Known exploited CVE

  8. Quiet for 5 days

    Mon 2 NovDay 121
    1. Brotli flaw prompts updates across runtimes and software03:31 · SecurityOnline · Picked up again · Known exploited CVE
  9. Tue 3 NovDay 131
    1. Arista patches two flaws that risk remote code execution03:30 · SecurityOnline · Known exploited CVE · This article, 22nd of 22

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in