CISA's KEV catalog lists CVE-2026-111497, attributed to Google and the Brotli product, added 2026-10-27 with a due date of 2026-11-10.
CISA describes the flaw as an unchecked return value issue allowing a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory, cause denial of service, or potentially execute arbitrary code via a crafted Brotli-compressed stream.
The 'known exploited' designation is asserted by CISA and is not independently corroborated within the packet; the entry does not disclose the underlying evidence, affected versions, a vendor patch, or ransomware use, which is recorded as 'Unknown'.
What the entry establishes
The retained CISA entry identifies CVE-2026-111497 as a vulnerability in Google's Brotli, added to the Known Exploited Vulnerabilities catalog on 2026-10-27. CISA's description states that an unchecked return value lets a remote unauthenticated attacker corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
CISA's required action directs applying mitigations per vendor instructions in compliance with BOD 26-04 and CISA's Forensics Triage Requirements, following BOD 26-04 guidance for cloud services or discontinuing use where mitigations are unavailable, with stakeholders responsible for evaluating each asset's internet exposure. The catalog due date is 2026-11-10.
What remains unverified
The packet contains only the CISA KEV entry. It does not disclose the specific evidence, telemetry, incident reports or vendor confirmation behind the 'known exploited' designation, nor affected Brotli versions or a vendor patch. Because the packet holds a single CISA-origin source, the designation is asserted by CISA and is not independently corroborated by any second source; the entry is authoritative for catalog status only.
The entry records known ransomware campaign use as 'Unknown'. The catalog addition and due dates are administrative, not timestamps of an exploitation event, so the packet establishes no event time for any exploitation.
Why it matters and what to watch
For defenders, the practical signal is the remediation deadline: CISA sets 2026-11-10 for applying mitigations under BOD 26-04, and the required action places responsibility on stakeholders to assess each asset's internet exposure. That obligation follows from the catalog listing, not from any exploitation detail supplied here.
The exploitation basis would be strengthened beyond CISA's assertion by independent researcher, vendor or incident-responder reporting corroborating exploitation; scope and remediation would be clarified by a Google advisory or patch specifying affected Brotli versions and mitigations; the 'Unknown' ransomware field would update with reporting of ransomware or targeted campaign use; and the 'known exploited' basis would be substantiated by CISA disclosure of the telemetry or incident evidence underlying the KEV designation.
Keep the boundaries visible.
- Only one retained source (CISA KEV entry, origin group us-cisa); no independent corroboration of exploitation exists in the packet.
- The packet does not disclose the exploitation evidence, actors, affected versions, or vendor patch status.
- Ransomware campaign use is recorded as 'Unknown' in the entry.
- No event timestamp for exploitation is established; catalog addition and due dates are administrative, not event timestamps.
- Coverage is limited to the retained sources in this packet. Automated review is not independent factual verification.
- Photos and video are omitted unless separate reuse and context checks succeed.