1-minute read
What a defender needs to know
Palo Alto Networks’ October 26 advisory puts CVE-2026-111497 on the PAN-OS dataplane inspection path of PA-Series and VM-Series firewalls. An affected build needs both Brotli inspection and TLS/SSL decryption enabled for the described exposure. A crafted compressed stream can corrupt decoder memory and potentially cause memory disclosure, a crash or code execution. Palo Alto Networks says it is unaware of malicious exploitation and explicitly excludes the management web and API interfaces. PAN-OS 11.1 and 10.2 and Panorama are unaffected.
Check each PAN-OS 11.2.4 or later firewall in the affected branches: record its installed build and dataplane TLS/SSL decryption setting, then run show system setting brotli. Enabled: yes means Brotli inspection is on. Disable Brotli inspection while the matching hotfix is pending with set system setting brotli-encoding disable, or uncheck Allow Brotli Encoding under Device > Setup > Content-ID and commit. Verify the change by running show system setting brotli again and expecting Enabled: no. Threat ID 97686, available in Applications and Threats content 9165 and later, provides partial coverage only.
The October 27 advisory no longer assigns ETAs to 12.2.4-h1, 12.1.7-h11 and 11.2.10-h17; other branch fixes retain estimates. Verify the matching build is available before scheduling it. Recheck the vendor build table for the installed maintenance line when fixes ship. Separately, update Prisma Cloud Application Security Transporter Client below 0.2.9 to 0.2.9 or later; this product has no special configuration prerequisite for exposure.