A few days ago, I wrote an article titled “AI Vulnerability Massacre: Is Your GIS System Still Okay?”, which introduced the Node.js vulnerability CVE-2026-111497 discovered by OpenAI. The scope of this vulnerability has begun to expand. On October 27, Esri released a security advisory for ArcGIS users. I have compiled the currently officially announced scope of impact and remediation methods. Please remember to upgrade in time.

About CVE-2026-111497

CVE-2026-111497 exists in Google's Brotli decoder. The affected versions are 1.0.3 through 1.2.0. Brotli is a general-purpose compression algorithm. The common Content-Encoding: br in web pages and APIs uses it. Currently, both Node.js and .NET are affected.

On October 22, OpenAI security researchers publicly disclosed a severe vulnerability in Google's Brotli decoder. People call it Node2Shell, Broccoli2Shell, or HTTP2Shell. On October 27, this vulnerability was added to the U.S. CISA's Known Exploited Vulnerabilities catalog.

Impact on Esri

Esri's current official response is that its product lines are still being investigated. For the .NET Runtime that is currently confirmed to be affected, users need to upgrade first.

Known affected products include ArcGIS Pro, IIS-based ArcGIS Web Adaptor, and ArcGIS Server. These products use the Microsoft .NET Runtime installed by customers themselves, so users need to update the version themselves.

Update address:

https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/#download-the-updates

PS: Users of GeoScene and other software that depends on the .NET Runtime should also remember to upgrade.

In addition, Esri has already addressed the vulnerabilities related to ArcGIS Online. Other affected components are still awaiting Esri's investigation.

Other Security Announcements

Esri also responded regarding the PHP vulnerability in my previous article “AI Vulnerability Massacre: Is Your GIS System Still Okay?”. Currently, the ArcGIS product line does not use PHP. Users only need to upgrade the PHP used in their own business systems.

Patches have also been released: ArcGIS Server Security 2026 Update 3 Patch and ArcGIS Velocity for ArcGIS Enterprise 12.1 Patch 1. If you use them, upgrade as soon as possible.

Summary

The geospatial information industry is one of the fields that are extremely sensitive to security, especially in China. Please do not let your guard down. Of course, if your business is entirely on an intranet and will never be exposed publicly in the future, just pretend I did not say that.

References

  1. Esri, Brotli Decoder Vulnerabilities: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
  2. Esri, October 2026 ArcGIS Security Bulletin: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/october-2026-arcgis-security-bulletin
  3. Esri, Recent PHP Vulnerabilities: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/recent-php-vulnerabilities
  4. ESRI Japan, Regarding the Impact of the Brotli Vulnerability on ArcGIS: https://support.esrij.com/news/37711
  5. Microsoft, .NET October 2026 Out-of-Band Security Updates: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/
  6. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2026-111497