Vulnerabilities · 16h ago

PAN-OS Brotli flaw can expose memory or disrupt firewalls

Palo Alto Networks lists fixes for one Brotli-decoder flaw, CVE-2026-111497, affecting PAN-OS firewalls and Prisma Cloud Application Security Transporter Client. On PAN-OS, exposure requires both Brotli inspection and TLS/SSL decryption enabled in the data plane; Panorama and PAN-OS 11.1 and 10.2 are unaffected. Fixes are available for selected maintenance lines, while others are scheduled for October 27–30.

When a firewall processes attacker-controlled compressed data, the flawed decoder can write past its buffer and corrupt nearby memory. A remote attacker needs no login, but the affected PAN-OS settings must be active. The result could be sensitive memory disclosure, service disruption or, potentially, code execution. One version trap: PAN-OS 11.2.10-h16 fixes PHP, not this Brotli flaw; the Brotli fix is in 11.2.10-h17.

For teams relying on version inventories, the configuration gate changes which firewalls are exposed: an affected release alone is not enough. A firewall running 11.2.10-h16 with both settings enabled remains vulnerable to this flaw.

CVE-2026-111497

NVD KEV

Known exploited · CISA KEV

Microsoft patch: Release Notes.

Patch available KB5133964 Download →

CISA federal remediation date Nov 10

Timeline

Nov 10 CISA federal deadline for CVE-2026-111497
Oct 27 Reported by INCIBE-CERT

Sources

1 source covering this story

INCIBE-CERT Oct 27
Escritura fuera de límites en productos de Palo Alto Networks
Khai Tran y Sylvie Mayer, de OpenAI Codex Security, han informado sobre una vulnerabilidad en el decod

Entities

CVE-2026-111497

Vendor digest: Palo Alto Networks

Part of the PlainSec briefing for 2026-10-27

Editions

Briefing for 2026-10-27

Vulnerabilities · 16h agoPAN-OS Brotli flaw can expose memory or disrupt firewallsPalo Alto Networks lists fixes for one Brotli-decoder flaw, CVE-2026-111497, affecting PAN-OS firewalls and Prisma Cloud Application Security Transporter Client. On PAN-OS, exposure requires both Brotli inspection and TLS/SSL decryption enabled in the data plane; Panorama and PAN-OS 11.1 and 10.2 are unaffected. Fixes are available for selected maintenance lines, while others are scheduled for October 27–30.When a firewall processes attacker-controlled compressed data, the flawed decoder can write past its buffer and corrupt nearby memory. A remote attacker needs no login, but the affected PAN-OS settings must be active. The result could be sensitive memory disclosure, service disruption or, potentially, code execution. One version trap: PAN-OS 11.2.10-h16 fixes PHP, not this Brotli flaw; the Brotli fix is in 11.2.10-h17.For teams relying on version inventories, the configuration gate changes which firewalls are exposed: an affected release alone is not enough. A firewall running 11.2.10-h16 with both settings enabled remains vulnerable to this flaw.