We have prepared a fix for the critical vulnerability (CVE-2026-111497) affecting the Brotli decompression library used by .NET. The fix is an upgrade to a newer, uncompromised version of the .NET framework.
Code changes have completed development and are progressing through the test cycle. Assuming no blockers are identified, a hotfix will be released to Production on 6 November 2026 between 02:00 and 06:00 in each region's local time, rolling out region by region. Deployment will begin in Australia at 02:00 AEDT on 6 November (15:00 UTC on 5 November).
The network-layer mitigation blocking Brotli-encoded requests, implemented previously, remains in place alongside this fix. No customer action is required. Once the hotfix is confirmed stable across all regions, the Brotli-blocking mitigation will be removed.
Affected Regions: - Australia - Canada - Europe - Qatar - South Africa - United Arab Emirates - United Kingdom - United States East - United States West - OrbusInfinity Government (FedRAMP) - OrbusInfinity Government (IRAP)
Next Update: Following completion of the hotfix deployment, or sooner if the situation changes.
Posted Nov 04, 2026 - 17:21 UTC
Update
We are continuing to work on a fix for this issue.
Posted Oct 30, 2026 - 17:55 UTC
Update
We are continuing to work on a fix for this issue.
Posted Oct 30, 2026 - 17:52 UTC
Identified
A critical security vulnerability (CVE-2026-111497) has been identified in the Brotli decompression library used by .NET, as outlined in the NET October 2026 Out-of-Band Security Updates. This vulnerability affects OrbusInfinity across all regions.
Preventative Measures: We are implementing preventative measures to protect customer data while a permanent patch is being prepared. These measures block requests with Brotli content encoding that could be exploited by this vulnerability. Some traffic may be impacted by these protective blocks.
Customer Impact: Some requests using Brotli compression may receive 403 responses. No customer action is required. We recommend monitoring your integrations and API calls for any unexpected 403 errors and contacting support if you experience issues.
Affected Regions: - Australia - Canada - Europe - Qatar - South Africa - United Arab Emirates - United Kingdom - United States East - United States West - OrbusInfinity Government (FedRAMP) - OrbusInfinity Government (IRAP)
Next Steps: We are working to deploy a permanent patch. Details on patching timeline and any further updates will be shared as soon as they are available.
Next Update: When patching timeline is confirmed or sooner if the situation changes.
Posted Oct 30, 2026 - 17:50 UTC
This incident affects: Canada (OrbusInfinity), Qatar (OrbusInfinity), South Africa (OrbusInfinity), United Arab Emirates (OrbusInfinity), United Kingdom (OrbusInfinity), Europe (OrbusInfinity), United States East (OrbusInfinity), United States West (OrbusInfinity), OrbusInfinity Government (IRAP) (OrbusInfinity), and OrbusInfinity Government (FedRAMP) (OrbusInfinity).