CVE-2026-111497 — a critical-severity out-of-bounds write in the Brotli decoder now being actively exploited by attackers, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
CVE-2026-111497: what the flaw does and why it matters
CISA confirmed that hackers have begun exploiting a vulnerability tracked as CVE-2026-111497 in the Brotli decompression code. The agency described the problem as an "unchecked return value vulnerability" in Google Brotli's decoder that can "corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream." Unprivileged attackers who supply a maliciously crafted Brotli-compressed stream can trigger crashes, memory leaks, and in some cases remote code execution on devices that incorporate a vulnerable Brotli library or binary.
Where the flaw was found and which software is affected
The issue was first identified in the Node.js JavaScript runtime environment, but CISA made clear the impact is broader: any HTTP servers and clients that rely on vulnerable Brotli implementations are at risk. In practical terms, that means both server- and client-side software that depends on the affected Brotli decoder could be abused by crafted compressed input to achieve the outcomes CISA described.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMicrosoft's .NET emergency update and privilege escalation risk
On Sunday, Microsoft issued an emergency .NET security update tied to the same underlying weakness, warning that "attackers could exploit it to escalate privileges on systems with a vulnerable .NET version." That advisory expands the scope of concern beyond web stacks that directly decode Brotli streams to include platforms that bundle Brotli decoding within managed runtime components.
CISA response: KEV listing and a federal two‑week patch mandate
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) Catalog and invoked Binding Operational Directive (BOD) 26-04, ordering U.S. government agencies to patch within two weeks — by November 10. While CISA's BOD applies only to federal agencies, the agency urged all network defenders to prioritize patching the flaw to block ongoing attacks.
For teams that cannot immediately apply the fixes, CISA recommended blocking incoming Brotli-compressed requests at the proxy or firewall level or disabling Brotli decoding until updates can be installed. After applying updates, administrators are required to restart affected processes and rebuild and redeploy affected container images to ensure the fixes take effect.
What this means for federal agencies, security teams, and enterprises
- Federal agencies: The directive is mandatory — agencies must apply patches and follow restart and container‑rebuild steps by November 10 to meet BOD 26-04 requirements and to address confirmed exploitation.
- Security teams: If immediate patching is not possible, teams should implement network-level mitigations (blocking Brotli-compressed requests at proxies or firewalls or disabling Brotli decoding) and plan for process restarts and container image rebuilds after updates.
- Enterprises and defenders managing production environments: CISA's alerts underscore that initial prevention can be bypassed. As the Blue Report 2026 notes, "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments — a reminder to monitor for post‑access lateral movement and credential abuse even after the immediate technical fix is applied.
The situation is straightforward and urgent: exploits are in the wild, fixes and mitigations exist, and the federal government has imposed a two‑week remediation deadline. The immediate operational imperative for defenders is clear — patch, restart, and rebuild where needed — and for those who cannot, apply the network‑level mitigations CISA recommends until updates are in place. Will all organizations treat the confirmed exploitation with the same urgency as federal agencies? The coming days will show who does.
Source: BleepingComputer — CISA warns of hackers now exploiting critical Node2Shell flaw
