From the Palo Alto Networks edition of November 3, 2026
Palo Alto Networks Brotli advisory (CVE-2026-111497): PAN-OS 11.2+ firewalls exposed only with Brotli inspection and TLS decryption; hotfixes shipped and cloud services remediated
Palo Alto Networks Product Security · Network security (PAN-OS firewalls), cloud security · Global security advisory
- Publisher
- Palo Alto Networks Security Advisories
- Original publication
- Palo Alto Networks Security Advisory, published Oct. 26, 2026; updated Oct. 31, 2026
- Source retrieved
- 2026-11-04
- Event date
- 2026-10-31
What happened
Palo Alto Networks rates the Brotli decoder buffer overflow (CVE-2026-111497) critical (CVSS-B 9.2) for affected products. PAN-OS 12.2, 12.1 and 11.2 on PA-Series and VM-Series firewalls are affected only when Brotli inspection and TLS/SSL decryption are both enabled on the dataplane; Brotli inspection is disabled by default from 11.2.4 and unsupported earlier. PAN-OS 11.1, 10.2 and the management interface are unaffected. The Prisma Cloud Application Security Transporter Client before 0.2.9 is affected. The timeline shows hotfix ETAs removed as builds shipped on Oct. 27, 28 and 29, a Threat Prevention signature removed from mitigations on Oct. 28, and on Oct. 31 Prisma Cloud and Strata Cloud Manager added to the list of cloud services remediated without customer action (alongside Prisma AIRS Gateway). The workaround is to disable Brotli inspection via CLI. Palo Alto says it is not aware of malicious exploitation.
Why it matters
Many state agencies, counties, universities and districts run PAN-OS firewalls with TLS decryption for threat and content inspection. Why now: the advisory has not been covered in this stream, all PAN-OS hotfixes were released by Oct. 29, the Oct. 31 update completed key cloud remediation, and CISA added the CVE to KEV on Oct. 27, which triggers patch deadlines for many state programs that follow KEV. Interpretation: SLED teams should confirm whether Brotli inspection was enabled and patched.
Evidence and measured results
Opened and read the full advisory, including product status table, solution table, workarounds, FAQ and timeline (published Oct. 26, updated Oct. 31).
Limitations and uncertainty
Vendor advisory; severity and exploitation status are vendor statements; the advisory remains under investigation and may change.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-04; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- SLED firewall owners must determine quickly whether a KEV-listed flaw affects their decryption-enabled PAN-OS fleet.
- Stakeholders
- Network security managers
- CISOs
- State patch compliance offices
- Cloud teams running VM-Series
- Discovery questions
- Which firewalls run PAN-OS 11.2, 12.1 or 12.2?
- Is Brotli inspection enabled where TLS decryption is on?
- Which KEV deadline applies?
- Are Prisma Cloud transporter clients below 0.2.9?
- Value hypothesis
- Interpretation: a configuration-based exposure check can close the issue quickly with minimal downtime.
- Potential engagement
- A rapid exposure assessment and hotfix plan for PAN-OS fleets.
- Unsupported claims
- That any customer was exploited
- That Threat Prevention content alone mitigates
- Exposure of PAN-OS 11.1 or 10.2
Pre-sales engineering
Role takeaway
- Fit
- Relevant to SLED entities on PAN-OS 11.2 or later with decryption; not relevant to 11.1 or 10.2 only.
- Architecture and integration
- Dataplane decryption and Brotli inspection on PA-Series and VM-Series; Prisma Cloud transporter client.
- Prerequisites
- Firewall inventory with versions
- Decryption policy records
- Support entitlement for hotfixes
- Constraints
- Hotfix requires change window
- VM-Series in cloud accounts may be untracked
- Advisory still under investigation
- Security
- Remote unauthenticated memory corruption through crafted compressed traffic; workaround is disabling Brotli encoding.
- Proof of value
- Run brotli setting check on all affected versions
- Verify fixed hotfix version after upgrade
- Confirm Prisma transporter client at 0.2.9 or later
Delivery
Role takeaway
- Work
- Inventory, apply workaround, schedule hotfixes and verify.
- Dependencies
- Change advisory board
- Vendor hotfix availability
- Cloud account inventory
- Ownership
- The network security manager owns remediation; the CISO tracks KEV compliance.
- Skills and adoption
- Admins need familiarity with PAN-OS CLI checks and hotfix trains.
- Governance checkpoints
- Exposure inventory completed
- Workaround or patch applied
- Post-change verification
- Acceptance criteria
- Proposed: zero unfixed devices with Brotli inspection enabled
- Proposed: remediation documented before KEV deadline
- Proposed: all transporter clients at 0.2.9 or later
- Risks
- Untracked VM-Series instances
- Hotfix regressions
- Advisory scope changes
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Exposure depends on dataplane configuration (Brotli inspection plus decryption) rather than version alone; Panorama and management interfaces are out of scope; SaaS components are vendor-remediated.
Governance
Who approves, reviews and stays accountable for outcomes?
Patch tracking should record configuration-based exposure decisions, especially where KEV-driven deadlines apply.
Security and privacy
What data, permissions and controls need testing?
A remote unauthenticated attacker could corrupt memory, disclose memory, cause denial of service or potentially execute code via crafted compressed traffic through inspecting firewalls.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Small IT teams can check exposure with one CLI command and apply a workaround while scheduling hotfixes.
Procurement
What should contracts, pricing and exit terms secure?
Limited; affected customers need active support entitlements to obtain hotfixes.
Operating model
Which teams own the service once it runs?
Reinforces configuration inventory for inspection features and change windows for firewall hotfixes.
Publication history
- 2026-11-03Palo Alto Networks · Issue 054 resources
Stable resource ID: pan-advisory-cve-2026-111497-brotli-pan-os-prisma-remediation-20261031