Google Brotli Vulnerability (CVE-2026-111497)

Kaseya is aware of a critical vulnerability in Google Brotli: CVE-2026-111497 CVE-2026-111497 is a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms and allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Customers should follow product-specific guidance for applicable updates and any required actions. We are actively managing the Brotli decoder vulnerability and tracking product-specific impact and remediation. Compensating controls, where implemented, are intended to reduce exposure and potential impact while remediation progresses. Our Security and Product teams continue to monitor affected environments and address outstanding remediation. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/