Splunk Visual Exporter

Two more vendors have shipped fixes for the same decoder flaw. Envoy's advisory of 2026-10-23 says a buffer overflow in its Brotli decompressor allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service or potentially execute arbitrary code with a crafted Brotli-compressed stream; it names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable, v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12 as fixed, and limits the impact to deployments that have the Brotli decompressor configured (Envoy, 2026-10-23). Microsoft's out-of-band .NET release of 2026-10-25 (8.0.33, 9.0.22, 10.0.14 and 11 Release Candidate 3) fixes the same CVE, and an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic decompression or the Brotli APIs (dotnet/announcements #494, 2026-10-25); .NET Blog, 2026-10-25 lists the fixed releases. As of 2026-10-26 no source reported exploitation outside Imperva's laboratory demonstration against Node.js.

NCSC Switzerland (BACS) published advisory 13105 on 2026-10-26 on the Brotli decoder flaw: it names Node.js, Microsoft .NET, Visual Studio, PowerShell, the Python Brotli and brotlicffi packages and Bun among the affected dependents, rated the exploitation status unknown with a proof of concept available in its text of that day, and gives as the temporary measure disabling Brotli decoding of untrusted data and rejecting Content-Encoding: br until patched, with services restarted and containers rebuilt after updating (NCSC Switzerland, 2026-10-26).

Palo Alto Networks lists PAN-OS 12.2 before 12.2.4-h1, 12.1 before 12.1.4-h13, 12.1.7-h11 and 12.1.10-h3, and 11.2 before 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 and 11.2.16-h1 as affected, but only on PA-Series and VM-Series firewalls that have inspection of Brotli-compressed traffic and TLS decryption enabled on the dataplane; PAN-OS 11.1 and 10.2 and the management interface are not affected, and the hotfixes carry estimated dates from 2026-10-27 to 2026-10-30 (Palo Alto Networks, 2026-10-26). Brotli encoding is disabled by default in PAN-OS 11.2.4 and later, the command show system setting brotli shows whether a firewall is exposed (Enabled: yes), and set system setting brotli-encoding disable is the vendor's interim mitigation; Palo Alto rates the urgency moderate and is not aware of malicious exploitation (Palo Alto Networks, 2026-10-26).

PHP rebuilt its Windows packages as 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 on 2026-10-26 with Brotli 1.2.1; the vulnerable decoder is reachable there through the cURL extension when automatic HTTP response decompression is enabled, which cURL leaves off by default (PHP, 2026-10-26). Ubuntu lists brotli fixes for 26.10 (1.2.0-4ubuntu0.1), 26.04 LTS (1.2.0-3ubuntu0.1), 24.04 LTS (1.1.0-2ubuntu0.1) and 22.04 LTS (1.0.9-2ubuntu0.1), marks 20.04 LTS as needing evaluation and its nodejs package on 20.04, which vendors Brotli, as vulnerable (Ubuntu, 2026-10-26).

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 2026-10-27 "based on evidence of active exploitation", naming no actor or victim (CISA, 2026-10-27). ELLIO's sensors recorded a public checker that maps hosts decompressing Brotli and then, on 2026-10-26, one Brotli-coded request body of about 23 MB built against Node.js 24.22.0 on x86-64, which ELLIO reads as adoption by an operator focused on mass exploitation; its own test of the attacker's chain against that build got no shell in 50 attempts, so a failed attempt shows as a worker crash (ELLIO, 2026-10-26). Tenable relays the report and has not confirmed it (Tenable, 2026-10-26); Cisco and Palo Alto report no malicious use against their own products (Cisco PSIRT, 2026-10-27; Palo Alto Networks, 2026-10-28). Palo Alto's advisory, as read on 2026-10-28, shows six of the nine PAN-OS hotfixes released and the other three, 12.1.4-h13, 12.1.10-h3 and 11.2.4-h23, due on 2026-10-29 and 2026-10-30 (Palo Alto Networks, 2026-10-29).

JFrog reproduced a remote crash of a ClickHouse server with one request carrying a crafted 23 MB body, with the fix merged but not released when it wrote (JFrog, 2026-10-25). Akamai gives a lever for Express 5 and body-parser 2 services that accept no compressed request bodies: set the inflate option to false (Akamai, 2026-10-26). A Node.js build is judged by its release version, because the bundled version string reads 1.2.0 on patched builds as well (ELLIO, 2026-10-26).

Broadcom's advisory VMSA-2026-0008, issued on 2026-10-27 and revised as 0008.1 on 2026-10-28 to clarify the impacted products, lists VMware Cloud Foundation's SDDC Manager as affected because it uses Node.js: a malicious actor with network access to SDDC Manager may exploit the flaw to execute arbitrary code (Broadcom, 2026-10-28). Broadcom rates it critical, CVSS 3.1 9.8, on SDDC Manager 9.1.1 only and important, 7.5, on 9.1.0, 9.0.x and 5.2.x, none has a patch yet, and workarounds are in KB460732 for 9.1.1 and KB460734 for the others (Broadcom, 2026-10-28).

Palo Alto Networks' timeline of 2026-10-29 removes the estimated dates of 11.2.4-h23, 12.1.4-h13 and 12.1.10-h3 because those builds are released, so every PAN-OS hotfix listed for this flaw is now available (Palo Alto Networks, 2026-10-29).

Patchstack reports that WordPress ships no Brotli of its own but links the operating system's libbrotli through libcurl, so one unauthenticated POST to xmlrpc.php can take down a PHP worker on a stock install: the pingback method makes WordPress fetch an attacker-named URL and decode the Brotli reply (Patchstack, 2026-10-30). A laboratory demonstration killed a worker or pinned it at full CPU, its author says no code execution is included, and Patchstack says no public chain aims at PHP; the fix is a patched libbrotli package, and the official wordpress:latest image still carried a vulnerable one when Patchstack wrote (Patchstack, 2026-10-30).

Splunk's advisory SVD-2026-1015, published on 2026-10-28 and updated on 2026-11-04, lists Splunk Enterprise, the Splunk Visual Exporter app, SOAR Automation Broker, UBA, Attack Analyzer, Python for Scientific Computing, several AppDynamics components and Smartlook as including packages affected by four Node.js flaws, CVE-2026-111497 among them; the page gives no CVSS score, no attacker position and no exploitation statement, and it covers the Brotli flaw and three DNS and TLS hostname-validation flaws together, so it does not show which of them reaches a given product (Splunk, 2026-10-28). Splunk Enterprise 10.0 and lower is vulnerable, Splunk recommends upgrading to 10.2 or higher for the bundled Node.js runtime and plans to upgrade the packages in a future 10.0 release, and the upgrade does not remediate the Visual Exporter app, which every Splunk Enterprise version includes and which Splunk says to disable or remove (Splunk, 2026-10-28). The page gives no fix for the other listed products.

Citrix bulletin CTX697300, published on 2026-10-30 and revised on 2026-11-03 with remediation for the LTSR and Cloud Gateway products, lists Unicon eLux Scout as affected by CVE-2026-111497 alone and names the fixes as hotfix 2609.1 for Scout On-Prem, 2508 CU2 LTSR for Scout On-Prem LTSR and 2605.1-3 for Scout Cloud Gateway On-Prem, without a vulnerable version range or an exploitation statement (Citrix, 2026-10-30). Neither Splunk nor Citrix says anything on malicious use against its products.