{"resourceId":"pan-advisory-cve-2026-111497-brotli-pan-os-prisma-remediation-20261031","versions":[{"version":"external-9d36e9d405839fc5e03656a045153595dd5de1c868cfe2679e92b65138bdccd4","resource":{"id":"pan-advisory-cve-2026-111497-brotli-pan-os-prisma-remediation-20261031","title":"Palo Alto Networks Brotli advisory (CVE-2026-111497): PAN-OS 11.2+ firewalls exposed only with Brotli inspection and TLS decryption; hotfixes shipped and cloud services remediated","organization":"Palo Alto Networks Product Security","sector":"Network security (PAN-OS firewalls), cloud security","geography":"Global security advisory","publishedAt":"Palo Alto Networks Security Advisory, published Oct. 26, 2026; updated Oct. 31, 2026","publicationDate":"2026-10-26","eventDate":"2026-10-31","sourceName":"Palo Alto Networks Security Advisories","sourceLabel":"CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks Products","sourceUrl":"https://security.paloaltonetworks.com/CVE-2026-111497","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["infrastructure","data-security"],"finding":"Palo Alto Networks rates the Brotli decoder buffer overflow (CVE-2026-111497) critical (CVSS-B 9.2) for affected products. PAN-OS 12.2, 12.1 and 11.2 on PA-Series and VM-Series firewalls are affected only when Brotli inspection and TLS/SSL decryption are both enabled on the dataplane; Brotli inspection is disabled by default from 11.2.4 and unsupported earlier. PAN-OS 11.1, 10.2 and the management interface are unaffected. The Prisma Cloud Application Security Transporter Client before 0.2.9 is affected. The timeline shows hotfix ETAs removed as builds shipped on Oct. 27, 28 and 29, a Threat Prevention signature removed from mitigations on Oct. 28, and on Oct. 31 Prisma Cloud and Strata Cloud Manager added to the list of cloud services remediated without customer action (alongside Prisma AIRS Gateway). The workaround is to disable Brotli inspection via CLI. Palo Alto says it is not aware of malicious exploitation.","sledRelevance":"Many state agencies, counties, universities and districts run PAN-OS firewalls with TLS decryption for threat and content inspection. Why now: the advisory has not been covered in this stream, all PAN-OS hotfixes were released by Oct. 29, the Oct. 31 update completed key cloud remediation, and CISA added the CVE to KEV on Oct. 27, which triggers patch deadlines for many state programs that follow KEV. Interpretation: SLED teams should confirm whether Brotli inspection was enabled and patched.","evidence":"Opened and read the full advisory, including product status table, solution table, workarounds, FAQ and timeline (published Oct. 26, updated Oct. 31).","architectureImplications":"Exposure depends on dataplane configuration (Brotli inspection plus decryption) rather than version alone; Panorama and management interfaces are out of scope; SaaS components are vendor-remediated.","governanceImplications":"Interpretation: patch tracking should record configuration-based exposure decisions, especially where KEV-driven deadlines apply.","securityPrivacyImplications":"A remote unauthenticated attacker could corrupt memory, disclose memory, cause denial of service or potentially execute code via crafted compressed traffic through inspecting firewalls.","caveats":"Vendor advisory; severity and exploitation status are vendor statements; the advisory remains under investigation and may change.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: this is a customer-care conversation, not a sales opportunity. Public-sector PAN-OS customers using TLS decryption want to know if they are exposed now that the flaw is on CISA KEV. A bounded engagement could be a rapid exposure check and hotfix plan across firewall fleets. The advisory supports a precise message: exposure requires Brotli inspection plus decryption, and fixes are available. It does not support claims that customers were attacked or that Threat Prevention alone protects them.","engineering":"Engineering framing: exposure is configuration-dependent. Engineers should run the show system setting brotli check on every PAN-OS 11.2, 12.1 and 12.2 firewall, confirm whether TLS decryption is enabled on the same devices, and map each to its fixed hotfix train. Where patching must wait, disable Brotli encoding and verify. Note the vendor removed the Threat Prevention signature from listed mitigations on Oct. 28, so do not rely on content updates. Check Prisma Cloud transporter client versions too.","delivery":"Delivery framing: run this as a short, tracked remediation. A plan would inventory affected firewalls, record Brotli and decryption settings, apply the workaround where needed, schedule hotfixes in change windows, and verify versions afterward. Proposed acceptance is zero affected devices with Brotli inspection enabled on an unfixed build and documented completion before any KEV-driven deadline. Risks include missed VM-Series instances in cloud accounts and hotfix regressions on heavily loaded firewalls."},"roleDetails":{"sales":{"customerProblem":"SLED firewall owners must determine quickly whether a KEV-listed flaw affects their decryption-enabled PAN-OS fleet.","stakeholders":["Network security managers","CISOs","State patch compliance offices","Cloud teams running VM-Series"],"discoveryQuestions":["Which firewalls run PAN-OS 11.2, 12.1 or 12.2?","Is Brotli inspection enabled where TLS decryption is on?","Which KEV deadline applies?","Are Prisma Cloud transporter clients below 0.2.9?"],"valueHypothesis":"Interpretation: a configuration-based exposure check can close the issue quickly with minimal downtime.","potentialEngagement":"A rapid exposure assessment and hotfix plan for PAN-OS fleets.","unsupportedClaims":["That any customer was exploited","That Threat Prevention content alone mitigates","Exposure of PAN-OS 11.1 or 10.2"]},"engineering":{"fit":"Relevant to SLED entities on PAN-OS 11.2 or later with decryption; not relevant to 11.1 or 10.2 only.","architectureIntegration":"Dataplane decryption and Brotli inspection on PA-Series and VM-Series; Prisma Cloud transporter client.","prerequisites":["Firewall inventory with versions","Decryption policy records","Support entitlement for hotfixes"],"constraints":["Hotfix requires change window","VM-Series in cloud accounts may be untracked","Advisory still under investigation"],"security":"Remote unauthenticated memory corruption through crafted compressed traffic; workaround is disabling Brotli encoding.","proofOfValue":["Run brotli setting check on all affected versions","Verify fixed hotfix version after upgrade","Confirm Prisma transporter client at 0.2.9 or later"]},"delivery":{"work":"Inventory, apply workaround, schedule hotfixes and verify.","dependencies":["Change advisory board","Vendor hotfix availability","Cloud account inventory"],"ownership":"The network security manager owns remediation; the CISO tracks KEV compliance.","skillsAdoption":"Admins need familiarity with PAN-OS CLI checks and hotfix trains.","governanceCheckpoints":["Exposure inventory completed","Workaround or patch applied","Post-change verification"],"acceptanceCriteria":["Proposed: zero unfixed devices with Brotli inspection enabled","Proposed: remediation documented before KEV deadline","Proposed: all transporter clients at 0.2.9 or later"],"risks":["Untracked VM-Series instances","Hotfix regressions","Advisory scope changes"]}},"retrievedAt":"2026-11-04T04:06:18Z","enrichedAt":"2026-11-04T04:09:09Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Small IT teams can check exposure with one CLI command and apply a workaround while scheduling hotfixes.","procurementImplications":"Limited; affected customers need active support entitlements to obtain hotfixes.","operatingModelImplications":"Reinforces configuration inventory for inspection features and change windows for firewall hotfixes.","sourceVerification":{"openedUrl":"https://security.paloaltonetworks.com/CVE-2026-111497","referenceExcerpt":"Palo Alto Networks is not aware of any malicious exploitation of this issue.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}