On October 22, 2026, Open AI security researchers announced a critical severity vulnerability in Google’s Brotli decoder, identified as CVE-2026-111497.
This CVE has generated considerable media attention and was listed as a Known Exploitable Vulnerability (KEV) on 10/27/26 leading customers to ask how ArcGIS software may be impacted. Media has established multiple names for the vulnerability including Node2Shell, Broccoli2Shell, and HTTP2Shell.
The impact of this vulnerability is being investigated across Esri product offerings, but in the meantime, we have provided mitigating steps you should consider for specific deployments circumstances:
ArcGIS Pro, ArcGIS Web Adaptor (IIS), & ArcGIS Server SOE/SOI’s
- These products utilize Microsoft’s .NET Framework which customers deploy separately from our products. Please immediately update your .NET Framework to a patched versions from Microsoft here.
- We strongly recommend that you already have processes in place to update this component regularly (See ArcGIS Enterprise Hardening Guide).
ArcGIS Online
- Mitigating measures have been deployed and updates in progress.
Check back frequently as additional information will be added here as more details are available.
Commenting is not enabled for this article.