Palo Alto Networks PAN-OS Brotli vulnerability lets attackers crash firewalls

Key Takeaways

• A critical Brotli vulnerability (CVE-2026-111497) impacts specific Palo Alto Networks PAN-OS firewall configurations and the Prisma Cloud Application Security Transporter Client.
• The flaw can lead to memory corruption, data exposure, service crashes, or unauthenticated code execution, with a CVSS score of 9.2.
• Affected PAN-OS firewalls require both Brotli traffic inspection and TLS/SSL decryption to be enabled on the dataplane.
• Palo Alto Networks is not aware of active exploitation, but advises immediate disabling of Brotli inspection as a workaround.
• Patches for PAN-OS are scheduled for release between October 27-30, and Prisma Cloud users should upgrade to client version 0.2.9 or later.

Palo Alto Networks Confirms Critical Brotli Vulnerability in PAN-OS Firewalls

Palo Alto Networks has issued an urgent advisory regarding a severe Brotli vulnerability, designated CVE-2026-111497, which impacts certain deployments of its PAN-OS firewalls and the Prisma Cloud Application Security Transporter Client. The flaw, disclosed on October 26, 2026, could enable attackers to compromise memory, expose sensitive data, crash services, or potentially execute arbitrary code without prior authentication.

Despite carrying a high CVSS score of 9.2, Palo Alto Networks has assigned a moderate response urgency, indicating no current evidence of malicious exploitation. The company’s investigation across its product portfolio and cloud services remains active. Customers are strongly advised to consult the official security advisory for the most up-to-date information regarding affected versions and patch availability.

Brotli Decoder Flaw Impacts PAN-OS

The vulnerability originates within the c/dec/decode.c component of Google’s Brotli decoder. A malformed compressed data stream can trigger an out-of-bounds write, causing the decoder to attempt writing data beyond its allocated memory buffer. This fundamental flaw has been addressed in Brotli releases 1.0.10, 1.1.1, and 1.2.1 across their respective development branches.

This particular Brotli vulnerability is not exclusive to Palo Alto Networks, having previously been identified and patched in other software, such as Node.js. Earlier reports have also highlighted its broader implications beyond typical web traffic, underscoring that fixing one application does not guarantee the removal of all vulnerable Brotli instances within an enterprise environment.

For Palo Alto Networks PAN-OS firewalls, the risk exposure is contingent on specific configurations. PA-Series and VM-Series firewalls are vulnerable only if both Brotli traffic inspection and TLS/SSL decryption are simultaneously enabled on the dataplane—the component responsible for processing network traffic. The management web interface and API are not susceptible to this flaw. It is important to note that Brotli inspection is disabled by default and is not supported in PAN-OS versions prior to 11.2.4.

PAN-OS versions 11.1 and 10.2 are not affected, nor are Panorama virtual appliances or M-Series appliances. Administrators operating PAN-OS 11.2.4 or newer can verify the status of Brotli inspection by executing the command show system setting brotli. An output displaying Enabled: yes indicates active Brotli inspection, but TLS/SSL decryption must also be enabled for the firewall to be at risk under the stated conditions.

Workarounds and Mitigation Strategies

Palo Alto Networks strongly recommends disabling Brotli inspection immediately as an interim measure while awaiting official patches. This can be achieved via the command-line interface by running set system setting brotli-encoding disable. Administrators should then confirm the setting is disabled by using show system setting brotli to ensure Enabled: no is displayed. For PAN-OS 12.1.2 and later, administrators can navigate to Device > Setup > Content-ID, deselect “Allow Brotli Encoding,” and commit the configuration.

Customers subscribed to Threat Prevention services may receive partial protection through Threat ID 97686, available in Applications and Threats content version 9165 or newer. However, this protection is conditional and not a comprehensive fix. The advisory specifies various prerequisites, including traffic routing, decryption, certificate, and policy requirements for the signature to be effective. Therefore, customers should not rely solely on installing the content update for complete protection.

Planned hotfixes for PAN-OS are anticipated between October 27 and October 30. These include versions 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, and 11.2.16-h1. These dates are estimates, and availability may vary. It is crucial to note that PAN-OS 11.2.10-h16 only addresses PHP-related issues, whereas 11.2.10-h17 provides fixes for both PHP and the Brotli vulnerability.

Users of the Prisma Cloud Application Security Transporter Client should upgrade to version 0.2.9 or later. Palo Alto Networks has confirmed that various listed cloud services, including ADEM, Cloud Identity Engine, Hub, and Prisma AIRS Gateway, have already been remediated without requiring any customer action.

What You Should Do

• Immediately Disable Brotli Inspection: For affected PAN-OS firewalls, disable Brotli inspection using the recommended CLI commands or GUI steps.
• Verify Disablement: Confirm that Brotli inspection is indeed disabled after applying the workaround.
• Monitor Advisory: Continuously check the official security advisory for updates on patch availability and any changes to affected versions.
• Upgrade Prisma Cloud Client: If using the Prisma Cloud Application Security Transporter Client, upgrade to version 0.2.9 or newer.
• Plan Patch Deployment: Once available, schedule and deploy the appropriate hotfixes for your PAN-OS firewalls based on the vendor’s guidance.
• Do Not Rely Solely on Threat Prevention: Understand that Threat Prevention signatures offer only conditional, partial coverage; they are not a substitute for disabling Brotli inspection or applying official patches.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.