Palo Alto Warns of Brotli Vulnerability in PAN-OS

Palo Alto Networks has confirmed the presence of a significant vulnerability related to the Brotli compression library in some of its PAN-OS firewall deployments and the Prisma Cloud Application Security Transporter Client. The flaw, identified as CVE-2026-111497, might allow attackers to corrupt memory, access sensitive information, disrupt services, or execute unauthorized code. Palo Alto disclosed this issue on October 26, 2026, urging users to take necessary precautions.

Understanding the Vulnerability’s Impact

The vulnerability, with a CVSS score of 9.2, is found in the c/dec/decode.c component of Google’s Brotli decoder. It can be exploited by sending a specially crafted compressed stream that results in an out-of-bounds memory write. Despite the high CVSS score, Palo Alto considers the response urgency to be moderate, as there have been no known cases of exploitation. The company advises users to stay updated through their official security advisory for any changes regarding affected versions and patching schedules.

This Brotli vulnerability is not only limited to PAN-OS but also affects other software utilizing Brotli. Previous reports by Cybersecurity News highlighted similar issues in Node.js and HTTP2Shell research, emphasizing that updating a single application might not eliminate all vulnerabilities within an organization.

Configuration and Exposure of PAN-OS

The vulnerability in PAN-OS is contingent on certain configurations. Specifically, PA-Series and VM-Series firewalls are at risk if Brotli traffic inspection and TLS/SSL decryption are enabled on the dataplane. The management interface and API are unaffected. By default, Brotli inspection is disabled and is unsupported in versions before PAN-OS 11.2.4.

Versions PAN-OS 11.1 and 10.2, along with Panorama and M-Series appliances, remain unaffected. Administrators can verify if Brotli inspection is active by using the command ‘show system setting brotli’. A response of ‘Enabled: yes’ indicates active Brotli inspection, though TLS/SSL decryption must also be enabled for vulnerability exposure.

Recommended Workarounds and Fixes

Palo Alto suggests disabling Brotli inspection while waiting for official fixes. Administrators can execute the command ‘set system setting brotli-encoding disable’ and confirm with ‘show system setting brotli’. On PAN-OS 12.1.2 and later, this can also be done via the Device Setup menu. Moreover, partial protection is available for Threat Prevention subscribers through Threat ID 97686, though it does not entirely resolve the issue.

The anticipated fixes for PAN-OS are scheduled between October 27 and 30, covering various builds, including 12.2.4-h1 and 11.2.16-h1. Prisma Cloud users are advised to upgrade to version 0.2.9 or higher. Palo Alto has already rectified issues in several cloud services without requiring customer action. Administrators should prioritize disabling Brotli inspection and monitor for the necessary hotfixes once they become available.

Staying ahead of potential threats involves promptly updating defenses against new malware and integrating threat intelligence feeds with data from numerous security operations centers worldwide.