Updated: Palo Alto Networks Releases Some PAN-OS Fixes for Brotli Vulnerability
Palo Alto Networks has made six PAN-OS hotfixes available for CVE-2026-111497. For three additional branches, the vendor continues to list ETA dates.
PAN-OS Brotli fixes for the CVE-2026-111497 vulnerability are now partially available. On October 28, 2026, Palo Alto Networks updated its security advisory and confirmed the release of six hotfixes for PA-Series and VM-Series firewalls in affected configurations. Three additional fixes remain only in the planned ETA stage for now.
The flaw is related to the processing of attacker-controlled data compressed using the Brotli format. Red Hat describes it as an out-of-bounds write. Exposure affects only devices with Brotli inspection and TLS/SSL decryption enabled in the data plane.
PAN-OS Brotli fixes are available for six versions
The vendor lists the following fixed versions as available:
- PAN-OS 12.2.4-h1,
- PAN-OS 12.1.7-h11,
- PAN-OS 11.2.10-h17,
- PAN-OS 11.2.7-h23,
- PAN-OS 11.2.13-h4,
- PAN-OS 11.2.16-h1.
Administrators using these branches should move to the relevant hotfix rather than relying on temporary measures and verify its deployment in their own environment. However, the mere presence of PAN-OS does not mean automatic exposure: the stated data-plane conditions are required.
Three hotfixes still have only an ETA
For the other branches, Palo Alto Networks has not yet announced that fixes are available to customers. The advisory lists an ETA of October 29, 2026, for PAN-OS 12.1.4-h13 and October 30, 2026, for PAN-OS 12.1.10-h3 and 11.2.4-h23.
An ETA does not confirm that a hotfix can already be downloaded or deployed. Organizations on these versions should therefore monitor the vendor’s advisory and verify the specific available build for their branch after release.
Threat ID 97686 is no longer listed as a mitigation
The updated advisory removed the reference to Threat ID 97686 from the mitigations section. This ID therefore can no longer be presented as partial coverage for the CVE-2026-111497 vulnerability. For administrators, it is important to distinguish between released fixes, unreleased hotfixes with ETAs, and configurations that meet the exposure conditions.
Palo Alto Networks continues to state that it has no information about known malicious exploitation of this flaw against its products. This is the vendor’s statement regarding its products, not a general confirmation that attacks against other products using the vulnerable Brotli library are absent.
It has not been publicly confirmed how many PA-Series and VM-Series deployments have both Brotli inspection and TLS/SSL decryption enabled, so the number of potentially exposed devices is unknown. Further advisory updates will be particularly important for the release of the three remaining hotfixes, any expansion of the list of affected products, and a change in exploitation status.
Sources
- Palo Alto Networks Security Advisory – CVE-2026-111497 – Confirms the released hotfixes, remaining ETAs, exposure conditions, removal of Threat ID 97686 from the mitigations, and the exploitation status stated by the vendor.
- Red Hat CVE record – CVE-2026-111497 – Independently describes the Brotli flaw as an out-of-bounds write requiring the processing of attacker-controlled Brotli data.
Verified and updated: October 28, 2026 14:10
