[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2TqZo1_5BjVEUcdWTAnxrlvyy0xJu7hSuxicCPdXrK4":3},{"article":4,"iocs":48,"watch_terms":61,"solutions":62,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"2c3e4999-4c0c-4807-a820-bb326ce1bc40","Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds","palo-alto-confirms-brotli-vulnerability-impact-on-pan-os-and-releases-workaround-ea04aa","Palo Alto Networks has confirmed that a critical Brotli vulnerability affects some PAN-OS firewall deployments and its Prisma Cloud Application Security Transporter Client. Tracked as CVE-2026-111497, the flaw could let an attacker corrupt memory, expose sensitive data, crash a service, or potentially run code without authentication. The company published its advisory on October 26, 2026. […] The post Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds appeared first on Cyber Security News.","Palo Alto Networks has confirmed a critical vulnerability (CVE-2026-111497) in the Brotli decoder used in some PAN-OS firewall deployments and its Prisma Cloud Application Security Transporter Client. The flaw could lead to memory corruption, data exposure, service crashes, or unauthenticated code execution. While Palo Alto Networks is not aware of active exploitation, they have released workarounds and are planning patches.","Palo Alto Networks confirms critical Brotli vulnerability affecting PAN-OS and Prisma Cloud.","https:\u002F\u002Fcybersecuritynews.com\u002Fbrotli-vulnerability-affects-pan-os\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FBrotli-Vulnerability-Impact-on-PAN-OS.webp","2026-10-27T04:17:51+00:00","2026-10-27T05:00:19.810074+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"Palo Alto Networks","vendor",{"name":21,"type":22},"PAN-OS","product",{"name":24,"type":22},"Prisma Cloud Application Security Transporter Client",{"name":26,"type":27},"Brotli","technology",{"name":29,"type":19},"Google","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,57],{"type":50,"value":51,"context":52},"cve","CVE-2026-111497","Critical Brotli vulnerability affecting PAN-OS and Prisma Cloud.",{"type":54,"value":55,"context":56},"mitre_attack","T1071.001","Web Protocols (HTTP\u002FHTTPS) - Potential for exploitation via crafted compressed streams.",{"type":58,"value":59,"context":60},"malware","HTTP2Shell","Related research showing Brotli decoder impact beyond web traffic.",[18,29,21],{"controls":63,"vendors":129},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":123,"name":124,"problem":125,"products":126},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[127,128],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},[130],{"slug":131,"name":18,"logo_path":132,"roles":133},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[134],"affected",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":147},"brotli-decoder-flaw-exposes-pan-os-firewalls-to-memory-corruption-and-code-execution","Brotli Decoder Flaw Exposes PAN-OS Firewalls to Memory Corruption and Code Execution","Palo Alto Networks confirmed that a critical vulnerability in the third-party Brotli decoder library (CVE-2026-111497) affects PAN-OS firewall deployments and the Prisma Cloud Application Security Transporter Client, potentially enabling unauthenticated code execution, memory corruption, and service crashes. The root issue stems from the inherited risk of embedding third-party or open-source components into critical security infrastructure without a robust process for tracking and rapidly patching those dependencies. This is a classic supply-chain-adjacent vulnerability management failure: the underlying library flaw existed before Palo Alto's product shipped it, yet customers are exposed until vendor patches arrive. The severity is amplified because the affected product is itself a security control — a compromised firewall can undermine an entire network's defenses. Organizations must not assume that security vendors self-manage these risks on acceptable timelines without customer-side pressure and compensating controls.",[140,141,142,143,144,145,146],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":148,"PCI DSS Requirement 6":149,"NIST SP 800-53 SI-2: Flaw Remediation":150,"OWASP A06:2021 Vulnerable and Outdated Components":151,"CIS Control 7: Continuous Vulnerability Management":152,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":153,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":154},"NIS2 mandates that operators of essential services implement incident handling and vulnerability management practices; the Brotli flaw in a network security appliance falls squarely within the critical infrastructure risk NIS2 is designed to address.","PCI DSS Requirement 6 demands that organizations protect systems and software from known vulnerabilities by installing security patches promptly, which applies directly to patching or applying workarounds for this critical PAN-OS library flaw in cardholder data environments.","SI-2 requires organizations to identify, report, and correct information system flaws, including those inherited from third-party components embedded in security appliances like PAN-OS, within organizationally defined timeframes.","The Brotli vulnerability is a textbook A06 scenario — a known-vulnerable third-party library was shipped inside a production product, exposing all downstream users until the vendor issued a patch or workaround.","A continuous vulnerability management process — including tracking third-party library CVEs in vendor products — would have flagged the Brotli flaw immediately and driven timely workaround deployment before exploitation risk matured.","This control explicitly requires timely identification of technical vulnerabilities in information systems and the taking of appropriate measures, directly covering the need to track and remediate the Brotli library flaw in PAN-OS.","Restricting unauthenticated access paths to the PAN-OS management plane is a compensating control that directly limits the blast radius of an unauthenticated code execution vulnerability while a patch is unavailable."]