Event Monitor Cyber
EM-20261031-PYDE VulnerabilityHigh severity

Google Brotli Unchecked Return Value Vulnerability

CVE-2026-111497 · Google Brotli

58 hours from first report to confirmed exploitation.

Status
Confirmed

Since : CISA added it to Known Exploited Vulnerabilities.

First Signal
Oct 28 17:43 UTCC123 Provider status pages (Statuspage)
Page Born
Oct 31 03:15 UTCsecond source joined
Last Signal
Nov 03 17:33 UTC23 hours before snapshot
Sources
32 official · 1 research, news or crowd
Open For
7 daysso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Oct 28 17:43 UTC
    C123 first to name it
  2. Scored: reached
    Oct 28 17:43 UTC
    No CVSS yet · EPSS 82.6%
  3. Exploited: reached
    Oct 31 03:15 UTC
    C1 CISA KEV, fix by 2026-11-10
  4. Advisories: not yet
    Not yet
    None yet
  5. Vendor Response: reached
    Oct 31 03:15 UTC
    C45 published
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline 2026-11-10, then 14 quiet days

Timeline

Oct 29Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4BornC123 Provider status pages (StatuspaC45 Palo Alto Networks Security AdviC26 GitHub Advisory Database

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. GHSA-p3jp-9v83-76w9: Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability (opens source in a new tab) nuget:Microsoft.DotNet.ILCompiler, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.ios-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-arm64, nuget:Microsoft.NETCore.App.Runtime.NativeAOT.iossimulator-x64… High severityDatabaseC26 GitHub Advisory Database
  2. Akamai: Customer Security Advisory: Brotli Remote Code Execution Vulnerabilities [CVE-2026-111497] (opens source in a new tab) resolved. As of November 2, 2026, at approximately 23:00 UTC, we completed all platform hardening measures to fully mitigate Akamai's potential exposure to the Brotli Remote Code Execution vulnerability (CVE-2026-111497)… Info severityProvider StatusC123 Provider status pages (Statuspage)
  3. CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL) (opens source in a new tab) High severityVendorC45 Palo Alto Networks Security Advisories
  4. Akamai: Customer Security Advisory: Brotli Remote Code Execution Vulnerabilities [CVE-2026-111497] (opens source in a new tab) investigating. Our investigation has revealed that a significant majority of our Platform is not affected by this CVE. We are continuing to investigate this issue to evaluate possible impact to customers and remaining Ak… Info severityProvider StatusC123 Provider status pages (Statuspage)