Citrix ships Unicon Scout fixes for the Brotli decoder flaw

Citrix ships Unicon Scout fixes for the Brotli decoder flaw

3 November 2026: Citrix has told customers running UniconOS Management (Scout) On-Prem and Scout Cloud Gateway On-Prem to install fixes "as soon as possible" for CVE-2026-111497, an unchecked return value in Google's Brotli decoder. Spain's national cyber response team rates the flaw critical and marks it as exploited, and it says a crafted data stream could lead to code execution.

Not yet independently verified. Citrix gives no CVSS score and no exploitation statement in the bulletin we read. The rating of critical and the mark of exploitation come from INCIBE alone. We will update this when it can be confirmed, and remove this note.

Three builds, one for each branch

Bulletin CTX697300 first appeared on 30 October. An update on 3 November changed the remediation section for the Scout product and its long-term branch along with the gateway, so anyone who read the first version should read it again.

The fixed builds it names are:

• UniconOS Management (Scout) On-Prem: Hotfix 2609.1
• Scout LTSR branch: 2508 CU2 LTSR
• Scout Cloud Gateway (SCG) On-Prem: 1 2605.1-3

Download links sit in the bulletin itself. Scout is the management console for UniconOS devices, so a compromised server would be one with a view across the endpoints it manages.

What the decoder flaw allows

INCIBE-CERT describes the bug as a failure to check a return value in the Brotli decoder, which lets a crafted stream cause a write outside the intended memory. It says the result could be memory corruption, leaked information, a denial of service or code execution, and that the flaw was reported by Khai Tran and Sylvie Mayer.

The same CVE has spread through products that bundle Brotli. Cisco's advisory, first published on 27 October and updated on 6 November, lists it among Node.js flaws affecting its own range, and it says no workarounds are available. We have already covered it in several other products, and the Citrix notice is one more case of the same library reaching a management server that may not be on anyone's Brotli list.

Finding Scout servers that were missed

Both named components are on-premises, so the work falls to the customer rather than to Citrix. Teams should check which branch each Scout server runs, because the LTSR line takes a different fix from the main hotfix, and check any Cloud Gateway separately, since it has its own version number.

Organisations already working through Brotli notices from other vendors should add these servers to that list rather than treat this as a separate job, because the fix in each case is the vendor's build, not a library update they can apply themselves.

Sources

• Citrix bulletin CTX697300: Security Advisory for CVE-2026-111497, impact on Unicon eLux Scout, published 30 October 2026, updated 3 November 2026, 3 November 2026
• INCIBE-CERT: Out-of-bounds write in Citrix products, INCIBE-2026-835, 4 November 2026, 4 November 2026
• Cisco advisory on Node.js and Brotli flaws, first published 27 October 2026, updated 6 November 2026, 6 November 2026