Customer Security Advisory: Brotli Remote Code Execution Vulnerabilities [CVE-2026-111497]

Timeline

1. 03 Nov · 17:13 UTC 🟢 Resolved atom

   Nov 3, 17:13 UTC
   Resolved - As of November 2, 2026, at approximately 23:00 UTC, we completed all platform hardening measures to fully mitigate Akamai's potential exposure to the Brotli Remote Code Execution vulnerability (CVE-2026-111497). All systems are secured, and we have detected no evidence of unauthorized access or impact to customer environments.
   
   Oct 28, 17:43 UTC
   Update - Our investigation has revealed that a significant majority of our Platform is not affected by this CVE. We are continuing to investigate this issue to evaluate possible impact to customers and remaining Akamai products. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAI. We will provide an update as we progress.
   
   Oct 26, 16:13 UTC
   Update - We are continuing to investigate this issue. The scope of this CVE has been expanded to include any foreign data which is being processed with the Brotli decoder, not just node.js. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAIWe will provide an update as we progress.
   
   Oct 24, 12:59 UTC
   Investigating - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAI We will provide subsequent updates as we make progress.
   
   Oct 24, 00:34 UTC
   Identified - We will continue to investigate and evaluate any possible impact to customers and our platform over the weekend. So far the investigation has not shown evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 20:07 UTC
   Update - We are continuing to investig

2. 28 Oct · 17:43 UTC 🟡 Identified atom

   Oct 28, 17:43 UTC
   Update - Our investigation has revealed that a significant majority of our Platform is not affected by this CVE. We are continuing to investigate this issue to evaluate possible impact to customers and remaining Akamai products. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAI. We will provide an update as we progress.
   
   Oct 26, 16:13 UTC
   Update - We are continuing to investigate this issue. The scope of this CVE has been expanded to include any foreign data which is being processed with the Brotli decoder, not just node.js. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAIWe will provide an update as we progress.
   
   Oct 24, 12:59 UTC
   Investigating - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAI We will provide subsequent updates as we make progress.
   
   Oct 24, 00:34 UTC
   Identified - We will continue to investigate and evaluate any possible impact to customers and our platform over the weekend. So far the investigation has not shown evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 20:07 UTC
   Update - We are continuing to investigate this issue to evaluate any possible impact to customers and our platform, so far we don't have evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation s

3. 26 Oct · 16:13 UTC 🟡 Identified atom

   Oct 26, 16:13 UTC
   Update - We are continuing to investigate this issue. The scope of this CVE has been expanded to include any foreign data which is being processed with the Brotli decoder, not just node.js. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAIWe will provide an update as we progress.
   
   Oct 24, 12:59 UTC
   Investigating - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAI We will provide subsequent updates as we make progress.
   
   Oct 24, 00:34 UTC
   Identified - We will continue to investigate and evaluate any possible impact to customers and our platform over the weekend. So far the investigation has not shown evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 20:07 UTC
   Update - We are continuing to investigate this issue to evaluate any possible impact to customers and our platform, so far we don't have evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 16:42 UTC
   Update - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAIWe will provide an update as we progress.
   
   Oct 23, 12:00 UTC
   Investigating - Akamai is aware of the recently published remote code execution vulnerability: CVE-2026-111497.Ou

4. 24 Oct · 12:59 UTC 🟡 Investigating atom

   Oct 24, 12:59 UTC
   Investigating - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAI We will provide subsequent updates as we make progress.
   
   Oct 24, 00:34 UTC
   Identified - We will continue to investigate and evaluate any possible impact to customers and our platform over the weekend. So far the investigation has not shown evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 20:07 UTC
   Update - We are continuing to investigate this issue to evaluate any possible impact to customers and our platform, so far we don't have evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 16:42 UTC
   Update - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAIWe will provide an update as we progress.
   
   Oct 23, 12:00 UTC
   Investigating - Akamai is aware of the recently published remote code execution vulnerability: CVE-2026-111497.Our subject matter experts are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. We will provide updates as additional information becomes available.In the interest of time, we are providing you with the most current information available, which is subject to changes, corrections, and updates.

5. 24 Oct · 00:34 UTC ⚪ Identified atom

   Oct 24, 00:34 UTC
   Identified - We will continue to investigate and evaluate any possible impact to customers and our platform over the weekend. So far the investigation has not shown evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 20:07 UTC
   Update - We are continuing to investigate this issue to evaluate any possible impact to customers and our platform, so far we don't have evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 16:42 UTC
   Update - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAIWe will provide an update as we progress.
   
   Oct 23, 12:00 UTC
   Investigating - Akamai is aware of the recently published remote code execution vulnerability: CVE-2026-111497.Our subject matter experts are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. We will provide updates as additional information becomes available.In the interest of time, we are providing you with the most current information available, which is subject to changes, corrections, and updates.

6. 23 Oct · 20:07 UTC 🟡 Identified atom

   Oct 23, 20:07 UTC
   Update - We are continuing to investigate this issue to evaluate any possible impact to customers and our platform, so far we don't have evidence of customer impact caused by this vulnerability. The appropriate subject matter experts are engaged. We will continue to provide updates until we have a clearer picture about the evaluation and the mitigation plan. Subsequent updates around mitigation status will be posted as progress is made.
   
   Oct 23, 16:42 UTC
   Update - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAIWe will provide an update as we progress.
   
   Oct 23, 12:00 UTC
   Investigating - Akamai is aware of the recently published remote code execution vulnerability: CVE-2026-111497.Our subject matter experts are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. We will provide updates as additional information becomes available.In the interest of time, we are providing you with the most current information available, which is subject to changes, corrections, and updates.

7. 23 Oct · 16:42 UTC 🟡 Identified atom

   Oct 23, 16:42 UTC
   Update - We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001apcFhCAIWe will provide an update as we progress.
   
   Oct 23, 12:00 UTC
   Investigating - Akamai is aware of the recently published remote code execution vulnerability: CVE-2026-111497.Our subject matter experts are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. We will provide updates as additional information becomes available.In the interest of time, we are providing you with the most current information available, which is subject to changes, corrections, and updates.

8. 23 Oct · 12:02 UTC ⚪ Investigating atom

   Oct 23, 12:00 UTC
   Investigating - Akamai is aware of the recently published remote code execution vulnerability: CVE-2026-111497.Our subject matter experts are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. We will provide updates as additional information becomes available.In the interest of time, we are providing you with the most current information available, which is subject to changes, corrections, and updates.

9. 23 Oct · 12:00 UTC ⚪ Investigating atom

   Oct 23, 12:00 UTC
   Investigating - Akamai is aware of the recently published remote code execution vulnerability: CVE-2026-111497.Our subject matter experts are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. We will provide updates as additional information becomes available.In the interest of time, we are providing you with the most current information available, which is subject to changes, corrections, and updates.