Brotli, Cisco and Sophos: When Configuration Decides Exposure

Two newly exploited vulnerabilities lead this week’s security wrap-up: a flaw in the widely used Brotli decoder and a Cisco firewall issue affecting remote access VPNs. The OPENVAS ENTERPRISE FEED already includes checks for both, plus a new Sophos UTM check and broader product-specific PHP2Shell coverage. These updates help security teams find affected assets across software, network devices, and operating system packages. In three of this week’s cases, though, the software version alone does not tell you whether a system is exposed. That depends on how the product is configured, so a scan finding starts the review rather than ending it.

Brotli Coverage Spans Software and Appliances

CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder. Software that decompresses attacker-controlled Brotli data may crash, disclose memory, or potentially allow code execution. Google, the CVE Numbering Authority for the flaw, rates the issue 9.2 on CVSS 4.0, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 27 October. Affected are Brotli versions 1.0.3 up to but not including 1.0.10, 1.1.0 up to but not including 1.1.1, and 1.2.0 up to but not including 1.2.1; the fixed versions are 1.0.10, 1.1.1 and 1.2.1.

Brotli is a library that other software bundles, so the same CVE shows up in many products. Canada’s Cyber Centre lists Node.js, Microsoft .NET, PowerShell, Bun, Envoy Proxy, Istio and the Python Brotli and brotlicffi packages among the affected technologies. Node.js fixed the bundled decoder in v22.23.4, v24.22.1 and v26.12.1.

Greenbone added checks for Node.js on Linux, macOS, and Windows, plus a PAN-OS check. Package coverage continued to grow on 2 November, when 19 newly generated distribution advisory checks included this CVE. That breadth matters because a shared component can surface in several products and update channels. As of 3 November, the OPENVAS ENTERPRISE FEED lists 82 checks for CVE-2026-111497, including:

• Node.js 22.x, 24.x and 26.x: Linux (package-level), macOS (executable version) and Windows (registry)
• Palo Alto PAN-OS 11.2, 12.1 and 12.2: package-level check
• 76 distribution advisory checks (package-level) for AlmaLinux, Amazon Linux, Debian, Fedora, Oracle Linux, Red Hat Enterprise Linux, Rocky Linux, SUSE, openSUSE, Slackware, Ubuntu and openEuler

For PAN-OS, exposure depends on Brotli inspection and TLS decryption settings, so teams should confirm configuration as well as software version. According to Palo Alto Networks, among PAN-OS devices, only PA-Series and VM-Series firewalls that inspect Brotli-compressed traffic with TLS/SSL decryption enabled are exposed. The management interface is not affected, and neither are PAN-OS 11.1 and 10.2. The CLI command show system setting brotli shows whether Brotli inspection is enabled. Fixed hotfixes are available for PAN-OS 11.2, 12.1 and 12.2; until they are installed, set system setting brotli-encoding disable turns Brotli inspection off.

Where an update cannot be installed right away, the Cyber Centre recommends preventing affected applications from processing Brotli-compressed content from untrusted sources until it is.

Cisco SSL VPN Exploitation Raises the Priority

CVE-2026-76418 can let an unauthenticated attacker cause an affected Cisco ASA or FTD device to reload through its remote access SSL VPN service. Cisco reports active exploitation and rates the issue 8.6 on CVSS 3.1. CISA added it to KEV on 29 October, and CERT-FR also reports the flaw as actively exploited.

Greenbone added separate checks for ASA (remote banner) and FTD (package-level) on the same day.

The vulnerable path requires a reachable SSL VPN service and secondary authentication configured on the affected tunnel group. Cisco points out two details that are easy to miss: the default tunnel group DefaultWEBVPNGroup counts too, and an attacker does not need a successful VPN login to reach the affected code. Teams using that configuration should review Cisco’s fixed releases and prioritize affected devices. Both Greenbone checks report vulnerable releases; where the SSL VPN and secondary authentication setup is not in place, the checks advise creating an override for the result.

The first fixed releases are:

• ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1
• FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1

Cisco states that no workaround addresses the vulnerability. Removing secondary authentication from the affected tunnel groups is a temporary mitigation, and Cisco strongly recommends upgrading to a fixed release.

Sophos UTM Needs a Manual Patch Review

A new Greenbone check (remote banner, added 30 October) also covers CVE-2026-118633 in Sophos UTM. Sophos describes a critical, unauthenticated path to root-level command execution when its email proxy is used with scanning enabled and an attacker wins a race condition. The underlying flaw is a path traversal, and all UTM versions are affected. UTM is end of life, and Sophos says the patch must be installed manually. The instructions are in knowledge base article KBA-000049692; the alternative is moving to a supported version of Sophos Firewall. The check identifies deployments that warrant review; administrators should confirm the email proxy configuration and patch status directly. Once the hotfix is installed, the check advises creating an override for the result.

Since Last Week: PHP2Shell Coverage Continues to Broaden

Greenbone has already published detailed PHP2Shell detection and scanning guidance. Since then, CISA has added both vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to KEV on 26 October. Recent feed additions extend the product-specific checks for both CVEs to further infrastructure products, including:

• Juniper Junos OS (JSA112681): Junos OS and Junos OS on SRX Series devices, both remote banner
• NetApp ONTAP 9 (NTAP-20261021-0021): remote banner check
• Aruba ClearPass Policy Manager (HPESBNW05171): package-level check
• Check Point Gaia (sk1000302): remote banner check

For Junos OS outside the SRX Series, no fix was available as of 27 October; SRX Series devices no longer use PHP from Junos OS 25.2R1 onwards. Teams should keep checking vendor products that ship PHP as well as standalone PHP installations.

Turn Coverage Into Action

Keep the OPENVAS ENTERPRISE FEED current, scan the relevant assets, and use the results with vendor guidance to plan updates. For this week’s items:

1. Trigger a manual feed update to get the new checks now.
2. Scan the assets that run Node.js, PAN-OS, Cisco ASA or FTD, Sophos UTM and PHP, including the operating system packages that bundle Brotli.
3. For every PAN-OS, Cisco and Sophos finding, compare the configuration with the conditions above before you set the priority. Where a condition is not met, or a hotfix is already installed, create an override for the result.

These checks identify potentially vulnerable versions or packages; a finding does not establish that an asset has been exploited.