Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds

Palo Alto Networks confirmed that a critical vulnerability in the third-party Brotli decoder library (CVE-2026-111497) affects PAN-OS firewall deployments and the Prisma Cloud Application Security Transporter Client, potentially enabling unauthenticated code execution, memory corruption, and service crashes. The root issue stems from the inherited risk of embedding third-party or open-source components into critical security infrastructure without a robust process for tracking and rapidly patching those dependencies. This is a classic supply-chain-adjacent vulnerability management failure: the underlying library flaw existed before Palo Alto's product shipped it, yet customers are exposed until vendor patches arrive. The severity is amplified because the affected product is itself a security control — a compromised firewall can undermine an entire network's defenses. Organizations must not assume that security vendors self-manage these risks on acceptable timelines without customer-side pressure and compensating controls.