Palo Alto Networks has confirmed a serious vulnerability in the Brotli compression decoder that affects certain PAN-OS firewall deployments and the Prisma Cloud Application Security Transporter Client. Tracked as CVE-2026-111497 with a CVSS score of 9.2, the flaw can lead to out-of-bounds memory writes that may allow attackers to corrupt memory, expose sensitive data, crash services, or — in some circumstances — execute code without authentication. Palo Alto’s advisory, published October 26, 2026, outlines affected configurations, immediate workarounds, and a schedule of planned hotfix releases.
What the vulnerability is
The bug resides in c/dec/decode.c of Google’s Brotli decoder. A specially crafted compressed stream can trigger an out-of-bounds write in the decoder, causing it to write beyond its allocated memory. Upstream Brotli fixes are available in releases 1.0.10, 1.1.1, and 1.2.1 for their respective branches. The same underlying issue also impacts other products that integrate Brotli, which is why organizations must consider the possibility of multiple vulnerable copies across their environment.
Which PAN-OS deployments are affected
Exposure on PAN-OS depends on how a device is configured. For PA-Series and VM-Series firewalls, the dataplane is at risk only if both Brotli traffic inspection and TLS/SSL decryption are enabled. The management web interface and API are not affected. Brotli inspection is disabled by default and is not supported prior to PAN-OS 11.2.4. PAN-OS 11.1 and 10.2 are unaffected, and Panorama virtual appliances and M-Series appliances are not impacted by this issue. Administrators can verify Brotli inspection on devices running 11.2.4 or later with the CLI command show system setting brotli; an Enabled: yes result indicates Brotli inspection is active, but TLS/SSL decryption must also be enabled for the stated exposure conditions to apply.
Immediate workarounds administrators can apply
Palo Alto recommends disabling Brotli inspection while awaiting formal fixes. From the command line, run:
set system setting brotli-encoding disable
Then confirm the change with:
show system setting brotli
On PAN-OS 12.1.2 and later, administrators can instead navigate to Device > Setup > Content-ID, clear Allow Brotli Encoding, and commit the configuration. Threat Prevention subscribers also receive partial coverage through Threat ID 97686 in Applications and Threats content version 9165 or later; however, this protection is conditional and does not constitute a complete fix. The advisory notes specific traffic routing, decryption, certificate, and policy requirements for the signature, so customers should not assume that installing the content update alone removes exposure.
Patch and hotfix timeline
Palo Alto outlined a set of planned hotfixes across PAN-OS builds with estimated dates spanning October 27–30. The builds listed include 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, and 11.2.16-h1. These dates were presented as estimates and do not guarantee immediate availability of every build. Palo Alto also highlighted that some sequential builds address different issues — for example, 11.2.10-h16 addressed PHP issues only, while 11.2.10-h17 includes fixes for both PHP and Brotli.
Guidance for Prisma Cloud and cloud services
Prisma Cloud Application Security Transporter Client users should upgrade to version 0.2.9 or later to mitigate exposure in that component. Palo Alto reported that several listed cloud services — including ADEM, Cloud Identity Engine, Hub, and Prisma AIRS Gateway — have been remediated without requiring customer action. Administrators should verify their specific service configurations and client versions to ensure they are running the patched releases.
Final recommendations
For exposed firewalls, the immediate priority is to disable Brotli inspection, verify the configuration change, and monitor Palo Alto’s advisory for the appropriate hotfix build that applies to each deployment. Where possible, coordinate Threat Prevention content updates and apply the conditional protections while planning to install vendor hotfixes as they become available. Because the Brotli decoder can appear in many components across an organization’s stack, teams should inventory software that relies on Brotli and apply updates to every affected component. Continue to update defenses against new malware and integrate threat intelligence feeds to stay informed about exploitation attempts and additional mitigations.
Licensed under CC BY-ND 4.0 International