Skip to content
VulniPulse
Sign in
Advisory severityCritical9.2Palo Alto Networks Exploited CISA KEV Updated

Critical [CVE-2026-111497] Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks Products

This critical-severity Palo Alto Networks advisory covers CVE-2026-111497 affecting Prisma Cloud, PAN-OS.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-111497 Source published

VulniPulse record published Record updated

CVE-2026-111497
Affected products & platforms
Palo Alto NetworksPAN-OSFirewallPrisma AccessPAN-OS / Panorama
Open source advisory

Get an email when Palo Alto Networks publishes the next one.

VulniPulse checks Palo Alto Networks's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.

Start your free month

Summary

CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability on Palo Alto Networks Products

Affected products named by the advisory: Prisma Cloud; PAN-OS.

CISA Known Exploited Vulnerability

Listed:
Oct 27, 2026 · federal remediation due Nov 10, 2026
Required action:
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEV is a prioritization signal from CISA. Remediation detail comes from the vendor advisory.

Affected versions
  • Prisma Cloud - Application Security Transporter Client < 0.2.9
  • PAN-OS < 12.2.4-h1
  • PAN-OS < 12.1.4-h13
  • PAN-OS < 11.2.4-h23

Official advisory · high-confidence parse· fetched 13 hours ago·verify at source

Fixed versions
  • Prisma Cloud - Application Security Transporter Client >= 0.2.9
  • PAN-OS >= 12.2.4-h1
  • PAN-OS >= 12.1.10-h3
  • PAN-OS >= 12.1.7-h11
  • PAN-OS >= 12.1.4-h13
  • PAN-OS >= 11.2.16-h1
  • PAN-OS >= 11.2.13-h4
  • PAN-OS >= 11.2.10-h17
  • PAN-OS >= 11.2.7-h23
  • PAN-OS >= 11.2.4-h23

Official advisory · high-confidence parse· fetched 13 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • This issue will be fixed in the upcoming releases of PAN-OS.
  • Refer Product Status table for details.
  • Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below.
  • Prisma Cloud - Application Security Transporter Client
Temporary workarounds
  • PAN-OSCustomers can mitigate the risk of this issue by taking any of the following actions:Disable Brotli Inspection via the CLI (PAN-OS 11.2.4 or higher):
  • Navigate to Device > Setup > Content-ID.
  • Locate the Content-ID settings pane and click the edit icon.Uncheck the Allow Brotli Encoding option.Commit the configuration changes.
  • or this Threat ID to protect against attacks for this vulnerability:

Official advisory · high-confidence parse· fetched 13 hours ago·verify at source

More Palo Alto Networks advisories

All Palo Alto Networks advisories

Android app · Google Play

Monitor future Palo Alto Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alertsSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.