Brotli Vulnerability CVE-2026-111497 Is in CISA KEV: What MSPs Should Do

What Happened

This Brotli vulnerability can cost an MSP in downtime, emergency labor, and client confidence. CVE-2026-111497 is now in CISA's Known Exploited Vulnerabilities catalog, which means active exploitation is confirmed. The fix is to patch affected runtimes and apply vendor workarounds now, then verify backups and recovery paths.

CISA added CVE-2026-111497 to its KEV database on October 27, 2026. A government advisory, AV26-1085, reports the flaw in Brotli versions 1.0.3 through versions prior to 1.0.10, 1.1.0 through versions prior to 1.1.1, and 1.2.0 through versions prior to 1.2.1. The flaw is an out-of-bounds write in the Brotli decoder that can permit remote code execution.

For an MSP, the immediate exposure is in client environments that bundle Brotli. Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli packages are all on the affected list. So is VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x. This is not a niche library issue. Brotli is a widely used compression algorithm, and this flaw sits in code that handles compressed data from untrusted sources.

Why This Matters for MSPs

CISA's KEV catalog is a priority list. When a CVE is added, it means the vulnerability is already being used in attacks. For an MSP, that removes the debate about whether to act. The only question is how fast you can find and fix affected client systems.

The real cost hits during recovery. A compromised client can mean ransom demands, stolen data, regulatory notification, and hours of recovery work that the client will expect you to absorb. A tested restore path is the difference between a short outage and a prolonged incident.

MSPs carry this risk across many clients. A single vulnerable library can be present in dozens of environments, and each one needs the same patching and recovery plan. That is why a repeatable process matters more than heroics.

Timeline

1. 2026-10-26: Fortinet PSIRT publishes advisory FG-IR-26-187 covering CVE-2026-111497 in the Node.js Brotli decoder.
2. October 27, 2026: CISA adds CVE-2026-111497 to its Known Exploited Vulnerabilities catalog.
3. 2026-11-05: Google Cloud publishes security bulletin GCP-2026-079 for VMware solution on Google Cloud, and Fortinet revises FG-IR-26-187.

Who Is Affected

A government advisory, AV26-1085, lists the affected Brotli versions and products. Vendor bulletins add detail for Node.js and VMware on Google Cloud. Check every client environment for these components, not just the ones you think use compression.

• Brotli versions 1.0.3 to versions prior to v1.0.10
• Brotli versions 1.1.0 to versions prior to v1.1.1
• Brotli versions 1.2.0 to versions prior to v1.2.1
• Node.js
• Microsoft .NET
• PowerShell
• Bun
• Envoy Proxy
• Istio
• Python Brotli and brotlicffi packages
• VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x

Brotli Vulnerability: Technical Details

CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder. Fortinet PSIRT describes it as a flaw in Node.js that can cause the Node.js Brotli decoder to perform an out-of-bounds write, permitting remote code execution. The Fortinet advisory lists affected Node.js versions as 26.x, 24.x, and 22.x.

Google Cloud states that Broadcom identified an out-of-bounds write remote code execution vulnerability in the SDDC Manager Node.js Brotli decoder. This impacts only VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x. It does not impact Google Cloud VMware Engine.

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026. That catalog entry is the confirmation that this vulnerability is being exploited in the wild.

What MSPs Should Do

Do these steps in order.

1. Apply the Broadcom-recommended workarounds outlined in the VMSA-2026-0008 advisory.
2. Review the vendor security bulletins, including Google Cloud GCP-2026-079 and Fortinet FG-IR-26-187, and apply any necessary updates as they become available.
3. Inventory client environments for affected Brotli versions and for every affected platform listed in this advisory.
4. Patch or update Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and the Python Brotli and brotlicffi packages to non-vulnerable versions.
5. Monitor vendor advisories for updated remediation, because this is an actively exploited vulnerability and the patch picture may change.
6. Verify backups and recovery paths for affected clients before you need them. In general, a clean restore is the last line of defense after an exploit.

How EnterProtect Helps

EnterProtect backup keeps clean, restorable copies of client systems. If a client environment is compromised, recovery gets that client running again from known-good data instead of leaving you to rebuild from scratch.

EnterProtect vulnerability scanning finds exposed versions across the environments you manage. That gives you a clearer view of where patching is needed and what to prioritize across your client base.

Frequently Asked Questions

What Is CVE-2026-111497?

CVE-2026-111497 is a critical vulnerability in the Brotli decoder. It is an out-of-bounds write that can permit remote code execution. CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026.

Which Brotli Versions Are Affected?

Affected versions are 1.0.3 through versions prior to 1.0.10, 1.1.0 through versions prior to 1.1.1, and 1.2.0 through versions prior to 1.2.1. The flaw also affects products that bundle Brotli, including Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio, and Python Brotli packages.

Is CVE-2026-111497 Actively Exploited?

Yes. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog, which means there is evidence of active exploitation. MSPs should treat affected systems as exposed and prioritize patching.

What Should MSPs Do First?

Apply the Broadcom-recommended workarounds in VMSA-2026-0008, review vendor advisories, and patch affected components as updates become available. Inventory client environments for affected Brotli versions and platforms. Verify backups and recovery paths in case a restore is needed.

Does This Affect VMware on Google Cloud?

Yes. VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x is affected, according to Google Cloud security bulletin GCP-2026-079. Google Cloud VMware Engine is not affected.

How Does the Brotli Flaw Lead to Remote Code Execution?

The vulnerability is an out-of-bounds write in the Brotli decoder. An attacker can exploit that memory error to execute code remotely on the affected system. The exact exploitation details are in the vendor advisories.

Sources

• Node2Shell CVEs (Fortinet Psirt)
• GCP-2026-079 (Google Cloud Security Corrected)