If your Brotli patch ticket covered application runtimes, add Windows build verification to the checklist.
What changed November 12, 2026. Microsoft’s CVE-2026-111497 revision 7.0 adds 24 Windows product rows and maps them to the November 10 Windows security updates. Microsoft originally published the advisory on October 25. Last verified November 12.
Applicability and fixed builds
Match the affected Windows release, architecture and servicing channel to the table. The security concern is an affected Brotli decoder processing untrusted compressed data. Microsoft’s revision does not identify a Windows-specific listener, feature toggle or workaround. The Windows 10 and Windows 11 packages apply only where the edition is eligible for the relevant servicing channel.
| Windows release | November cumulative update and build | Hotpatch and build |
|---|---|---|
| Windows 10 1809 and Windows Server 2019 (including Core) | KB5131085 · 17763.9487 | — |
| Windows 10 21H2 / 22H2 | KB5131096 · 19044.7846 / 19045.7846 | — |
| Windows 11 23H2 | KB5131087 · 22631.7711 | — |
| Windows 11 24H2 / 25H2 / 26H2 | KB5132061 · 26100.9974 / 26200.9974 / 26300.9974 | KB5132043 · 26100.9911 / 26200.9911 / 26300.9911 |
| Windows 11 26H1 | KB5132059 · 28000.3501 | — |
| Windows Server 2022 (including Core) | KB5131090 · 20348.5870 | — |
| Windows Server 2025 (including Core) | KB5131080 · 26100.33822 | KB5131077 · 26100.33730 |
The hotpatch rows apply to eligible devices already enrolled in hotpatching and on Microsoft’s stated baseline. Check the respective KB5132043 and KB5131077 prerequisites before rollout. The full cumulative updates require a restart.
Severity and exploitation
Microsoft lists CVSS 3.1 at 8.1 for the added Windows rows. Its Windows 11 26H2 entries specify Critical remote code execution. The other newly added Windows rows leave the per-product severity and impact labels blank. MSRC marks the advisory publicly disclosed, exploitation more likely, and exploited no. CISA added the shared Google Brotli issue to KEV on October 27, with a November 10 federal deadline. The KEV entry confirms exploitation of the shared component. Windows-specific exploitation and a Microsoft-directed compromise or credential-rotation procedure remain unverified.
MSP rollout
Suggested priority. High for affected systems, with exposed services that handle untrusted compressed data first.
- Inventory. Group Windows endpoints and servers by release, architecture, edition, running build and hotpatch eligibility. Use Intune reporting where enrolled and your server inventory for the rest.
- Prioritize. Start with affected systems that handle untrusted compressed input. If a necessary update must wait, reduce unnecessary access to exposed services while staging it.
- Roll out. Deploy the applicable November update or a superseding security update. Reboot where required. Keep separate remediation checks for applications that ship their own decoder.
- Verify. Confirm the installed KB and running OS build after rollout, check pending restarts and test the services that depend on the updated hosts.
Official sources include the Microsoft CVE advisory, MSRC October CVRF (revision 7.0 for this CVE), CISA KEV catalog data and the Microsoft Support links in the table.