Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds

Palo Alto Networks has confirmed that a critical Brotli vulnerability affects some PAN-OS firewall deployments and its Prisma Cloud Application Security Transporter Client.

Tracked as CVE-2026-111497, the flaw could let an attacker corrupt memory, expose sensitive data, crash a service, or potentially run code without authentication. The company published its advisory on October 26, 2026.

The vulnerability carries a CVSS score of 9.2, although Palo Alto assigns it moderate response urgency. The company says it is not aware of malicious exploitation. Its investigation across products and cloud services remains ongoing, so customers should check the official security advisory for changes to affected versions and patch schedules.

Brotli Vulnerability Affects PAN-OS

The flaw sits in c/dec/decode.cpart of Google’s Brotli decoder. A specially crafted compressed stream can trigger an out-of-bounds write, meaning the decoder writes beyond its intended memory area. Fixed Brotli releases include 1.0.10, 1.1.1, and 1.2.1 for their respective release branches.

The same vulnerability also affects other software that uses Brotli. Cybersecurity News previously covered Node.js security updates addressing the decoder flaw and HTTP2Shell research showing its impact beyond web traffic. Those reports show why updating one application may not remove vulnerable copies elsewhere in an organization.

For PAN-OS, exposure depends on configuration. PA-Series and VM-Series firewalls must have both Brotli traffic inspection and TLS/SSL decryption enabled on the dataplane, which processes network traffic. The management web interface and API are not affected. Brotli inspection is disabled by default and is unsupported before PAN-OS 11.2.4.

PAN-OS 11.1 and 10.2 are unaffected, as are Panorama virtual appliances and M-Series appliances. Administrators running PAN-OS 11.2.4 or later can check the setting with show system setting brotli. An Enabled: yes result confirms Brotli inspection is active, but TLS/SSL decryption must also be enabled for the stated exposure conditions.

Workarounds Administrators Can Apply

Palo Alto recommends disabling Brotli inspection while awaiting fixes. Through the command-line interface, administrators can run set system setting brotli-encoding disable, then use show system setting brotli to confirm Enabled: no. On PAN-OS 12.1.2 and later, they can instead open Device > Setup > Content-ID, clear Allow Brotli Encoding, and commit the configuration.

Threat Prevention subscribers also receive partial coverage through Threat ID 97686 in Applications and Threats content version 9165 or later. This protection is conditional, not a complete fix. The advisory specifies traffic routing, decryption, certificate, and policy requirements for the signature, so customers should not assume installing the content update alone provides protection.

The planned PAN-OS fixes span October 27–30. They include 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, and 11.2.16-h1. These dates are estimates, not confirmation that every build is available. Notably, 11.2.10-h16 fixes PHP issues only, while 11.2.10-h17 addresses both PHP and Brotli.

Prisma Cloud Application Security Transporter Client users should upgrade to version 0.2.9 or later. Palo Alto says listed cloud services, including ADEM, Cloud Identity Engine, Hub, and Prisma AIRS Gateway, have been remediated without customer action. For exposed firewalls, the immediate priority is to disable Brotli inspection, verify the setting, and track the appropriate hotfix for deployment once available.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds appeared first on Cyber Security News.