A firewall can be affected by the traffic it inspects. Broadcom’s November 5, 2026 guidance (KB460729) identifies Layer 7 rules in vDefend that can lose inspection or disrupt the gateway datapath when they process a crafted Brotli stream.
Advisory: Broadcom KB460729, CVE-2026-111497. Vendor guidance: November 5, 2026. Last verified: November 6, 2026. Suggested MSP priority: High where the affected rules inspect untrusted traffic. Broadcom provides no vDefend-specific CVSS score or severity rating in this KB.
Which policies to check
Check vDefend Distributed Firewall and Gateway Firewall on VCF NSX 4.2.x and 9.x. The exposure applies when Layer 7 rules use Context Profile App IDs HTTP, HTTP2, HTTP3, SPDY or WEBSOCKET. Broadcom excludes Security Services Platform for vDefend 5.x and License Hub for vDefend and Avi 2.x.
On Distributed Firewall, the Layer 7 inspection engine can crash. New Layer 7 connections can go without that inspection during restart, and intrusion detection and prevention can be affected. New Layer 4 connections continue to be inspected. On Gateway Firewall, Broadcom says the datapath can crash.
Exploitation and fix status
CISA added the underlying Google Brotli vulnerability to KEV on October 27, 2026, with a November 10, 2026 federal deadline. Broadcom describes inspection and availability impact in vDefend. Its guidance provides no confirmation of in-the-wild exploitation or remote code execution against vDefend itself.
Broadcom lists fixes in upcoming releases and gives no fixed build. Its interim workaround is to remove or disable rules with the affected App IDs. That removes the inspection those rules provide. Broadcom also documents signatures 1156325 for exploit attempts and 1156326 for unusually large Brotli-encoded HTTP requests. These are detection signals for protected applications.
What I would do across customer environments
- Inventory NSX versions and export Distributed Firewall and Gateway Firewall policy. Find the affected App IDs and identify which rules handle untrusted traffic.
- Prioritize exposed gateways. Confirm which traffic controls depend on the affected rules, then test and stage independent inspection or segmentation before disabling the rules where warranted.
- Verify connectivity, the remaining policy enforcement and IDS/IPS coverage. Monitor inspection engine or gateway datapath restarts and signature hits. Recheck KB460729 for a fixed build before scheduling the permanent rollout.
Official sources: Broadcom KB460729 and CISA KEV entry.