Security Advisory: CVE-2026-111497 - Critical .NET Vulnerability

Update timeline

1. identified Oct 30, 2026, 05:50 PM UTC

   A critical security vulnerability (CVE-2026-111497) has been identified in the Brotli decompression library used by .NET, as outlined in the NET October 2026 Out-of-Band Security Updates. This vulnerability affects OrbusInfinity across all regions. Preventative Measures: We are implementing preventative measures to protect customer data while a permanent patch is being prepared. These measures block requests with Brotli content encoding that could be exploited by this vulnerability. Some traffic may be impacted by these protective blocks. Customer Impact: Some requests using Brotli compression may receive 403 responses. No customer action is required. We recommend monitoring your integrations and API calls for any unexpected 403 errors and contacting support if you experience issues. Affected Regions: - Australia - Canada - Europe - Qatar - South Africa - United Arab Emirates - United Kingdom - United States East - United States West - OrbusInfinity Government (FedRAMP) - OrbusInfinity Government (IRAP) Next Steps: We are working to deploy a permanent patch. Details on patching timeline and any further updates will be shared as soon as they are available. Next Update: When patching timeline is confirmed or sooner if the situation changes.

2. identified Oct 30, 2026, 05:52 PM UTC

   We are continuing to work on a fix for this issue.

3. identified Oct 30, 2026, 05:55 PM UTC

   We are continuing to work on a fix for this issue.