Palo Alto Networks has confirmed a serious security flaw in its PAN-OS firewall platform and the Prisma Cloud Application Security Transporter Client, tied to a vulnerability in the Brotli compression library. Tracked as CVE-2026-111497, the bug can lead to out-of-bounds memory writes—enabling memory corruption, exposure of sensitive data, crashes, or even code execution, all without any authentication. The company issued its advisory on October 26, 2026. PAN-OS users should treat this issue with urgency despite its formal “moderate” response rating, given its 9.2 CVSS score. No active exploitation has been observed so far. The investigation remains ongoing.
How PAN-OS Firewalls Are Affected
The vulnerability lies in the Brotli decoder’s “c/dec/decode.c” component. A maliciously crafted compressed data stream can trigger this out-of-bounds write. Fixed versions of Brotli are already available—namely 1.0.10, 1.1.1, and 1.2.1 across different branches.
For PAN-OS firewalls, risk depends on configuration. Only PA-Series and VM-Series models that have both Brotli traffic inspection enabled and TLS/SSL decryption on the dataplane are vulnerable. The management interface and API are not affected. Brotli inspection is disabled by default and is unsupported on versions before PAN-OS 11.2.4. Versions 11.1 and 10.2, plus Panorama virtual appliances and M-Series hardware, are not impacted. To check status, admins can run “show system setting brotli”—if the output shows “Enabled: yes” and TLS decryption is in use, the system is at risk.
Workarounds & Upcoming Fixes
While official fixes roll out, Palo Alto recommends disabling Brotli inspection on affected firewalls. This can be done via the CLI with “set system setting brotli-encoding disable,” then verified with “show system setting brotli.” For PAN-OS 12.1.2 and up, users may also disable Brotli Encoding through the GUI under Device → Setup → Content-ID.
Partial protection is provided through Threat Prevention’s Threat ID 97686 in the Applications and Threats content version 9165 or later. However, this signature only triggers under specific conditions—dependent on how traffic is routed, decrypted, and how policies are set—and is not a substitute for full mitigation.
Official hotfixes are expected between October 27 and 30. Affected builds include 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, and 11.2.16-h1. Prisma Cloud Application Security Transporter Client users should update to version 0.2.9 or newer. Several Palo Alto cloud services—including ADEM, Cloud Identity Engine, Hub, and the Prisma AIRS Gateway—have already been patched with no user action required.
