CISA Adds Node2Shell Brotli Flaw to KEV as Honeypots Record Exploitation Attempts
Summary
CISA added the Node2Shell Brotli flaw (CVE-2026-111497) to its KEV catalog. Honeypots recorded attempts, but ELLIO found its observed exploit failed; patches are pending for affected VMware products.
Key points
- CISA added CVE-2026-111497 to its KEV catalog on October 27 and set a November 10 remediation deadline for federal civilian agencies.
- The out-of-bounds write affects Brotli versions 1.0.3 through 1.2.0 and may enable crashes, memory disclosure, or arbitrary code execution.
- Node.js, Google, Microsoft, Bun, Envoy, Istio, and maintainers of two Python packages have released fixes; Palo Alto Networks is rolling out PAN-OS hotfixes.
- Previdian reported one honeypot exploitation attempt on October 27, while clarifying that its confidence rating does not mean the attempt succeeded.
- ELLIO reported a malicious request targeting Node.js 24.22.0, but said the exploit's final stage failed to produce a shell in 50 tests.
- Broadcom says VMware SDDC Manager in Cloud Foundation and vSphere Foundation is affected; patches are pending, with workarounds available.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Severity
- Broadcom rates CVE-2026-111497 critical (CVSS 9.8) for SDDC Manager 9.1.1 and important (CVSS 7.5) for versions 9.0.x, 9.1.0, and 5.2.x.
- Affected Versions
- Brotli 1.0.3 through 1.2.0
- SDDC Manager 9.1.1
- SDDC Manager 9.0.x, 9.1.0, and 5.2.x
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
MITRE ATT&CK
T1210 · Exploitation of Remote ServicesBroadcom said an attacker with network access to SDDC Manager could exploit CVE-2026-111497 to execute arbitrary code.T1499.004 · Application or System ExploitationELLIO warned that failed attempts using the vulnerability can crash the targeted process and be used for denial-of-service attacks.
CVE
Vendors
BroadcomBroadcom warned on October 27 that SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected by CVE-2026-111497 because it uses Node.js.GoogleTracked as CVE-2026-111497 and also known as HTTP2Shell and Broccoli2Shell, the flaw is an out-of-bounds write in the decoder of Brotli, the data compression library developed by Google.MicrosoftMicrosoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.Palo Alto NetworksMicrosoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.
Products
BrotliThe US cybersecurity agency CISA has added the Brotli vulnerability known as Node2Shell to its Known Exploited Vulnerabilities (KEV) catalog.BunMicrosoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.EnvoyMicrosoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.IstioMicrosoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.Node.jsThe bug was reported by researchers at OpenAI, and Node.js and Google released fixes on October 21.PAN-OSMicrosoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.SDDC ManagerBroadcom warned on October 27 that SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected by CVE-2026-111497 because it uses Node.js.VMware Cloud FoundationBroadcom warned on October 27 that SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected by CVE-2026-111497 because it uses Node.js.vSphere FoundationBroadcom warned on October 27 that SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected by CVE-2026-111497 because it uses Node.js.