Event Monitor Cyber
EM-20261028-PYDE VulnerabilityHigh severity

Google Brotli Unchecked Return Value Vulnerability

CVE-2026-111497 · Google Brotli

5 hours from first report to confirmed exploitation.

Status
Confirmed

Since : CISA added it to Known Exploited Vulnerabilities.

First Signal
Oct 28 12:46 UTCC10 Canadian Centre for Cyber Security
Page Born
Oct 28 17:43 UTCsecond source joined
Last Signal
Nov 03 17:33 UTC18 hours before snapshot
Sources
43 official · 1 research, news or crowd
Open For
7 daysso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Oct 22 14:17 UTC
    C6 NVD published
  2. Scored: reached
    Oct 22 14:17 UTC
    CVSS 9.2 · EPSS 82.6%
  3. Exploited: reached
    Oct 28 17:43 UTC
    C1 CISA KEV, fix by 2026-11-10
  4. Advisories: reached
    Oct 28 12:46 UTC
    1 government and CERT sources
  5. Vendor Response: reached
    Oct 31 03:15 UTC
    C45 published
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline 2026-11-10, then 14 quiet days

Timeline

Oct 29Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4BornC10 Canadian Centre for Cyber SecuriC123 Provider status pages (StatuspaC45 Palo Alto Networks Security AdviC26 GitHub Advisory Database

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. GHSA-p3jp-9v83-76w9: Micro oft Security Advi ory CVE-2026-111497 - .NET Brotli Decoder Out-of-bound Write Vulnerability (opens source in a new tab) nuget:Microsoft.DotNet.ILCompiler, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64… High severityDatabaseC26 GitHub Advisory Database
  2. Akamai: Cu tomer Security Advi ory: Brotli Remote Code Execution Vulnerabilitie [CVE-2026-111497] (opens source in a new tab) resolved. As of November 2, 2026, at approximately 23:00 UTC, we completed all platform hardening measures to fully mitigate Akamai's potential exposure to the Brotli Remote Code Execution vulnerability (CVE-2026-111497)… Info severityProvider StatusC123 Provider status pages (Statuspage)
  3. CVE-2026-111497 Portfolio Statu : Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Network Product (Severity: CRITICAL) (opens source in a new tab) High severityVendorC45 Palo Alto Networks Security Advisories
  4. Akamai: Cu tomer Security Advi ory: Brotli Remote Code Execution Vulnerabilitie [CVE-2026-111497] (opens source in a new tab) investigating. Our investigation has revealed that a significant majority of our Platform is not affected by this CVE. We are continuing to investigate this issue to evaluate possible impact to customers and remaining Ak… Info severityProvider StatusC123 Provider status pages (Statuspage)
  5. AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497 (opens source in a new tab) Med severityGovernmentC10 Canadian Centre for Cyber Security