CVE-2026-111497 – Applicability to Celonis On-Premise Clients / Extractor Server

Hi ​@nikhil.more ,

I'm not Celonis staff, so for an official statement please open a support ticket and ask for a written applicability statement for those exact versions. I couldn't find any Celonis advisory on this CVE so far. Here is the technical side, going through your questions in order.

1 and 2. The on-prem clients system requirements list Java 25 or later as the runtime, and the JDBC extractor prerequisites list Java 17 to 25. Neither page lists .NET as a dependency.

3. The file you found, System.IO.Compression.Brotli.dll, is only the managed wrapper. The decoder itself is compiled into System.IO.Compression.Native.dll in the same folder, so that's the name to check for. Run this as admin while an extraction is running.

tasklist /m System.IO.Compression.Native.dll

If no Celonis process shows up in that list, none of them has the .NET Brotli decoder loaded. Also, per the docs, both the on-prem clients and the uplink extractors only need outbound connections (to your sources and to Celonis on 443) and no inbound ports, so nobody outside can hand them a crafted Brotli stream directly.

4. No fix is coming for 6.0.32. .NET 6 has been out of support since Nov 2024, and Microsoft only shipped fixes for .NET 8, 9 and 10. The remediation is finding what uses that runtime and moving it to .NET 8 or later, or removing .NET 6 if nothing does. The command below lists the vendor folder of every app built for .NET 6 and skips the .NET install folder itself. No output means nothing was found in those folders. Add C:\inetpub or other drives if apps live there.

Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)', 'C:\ProgramData' -Recurse -Filter *.runtimeconfig.json -ErrorAction SilentlyContinue | Where-Object { $_.FullName -notmatch '^C:\\Program Files( \(x86\))?\\dotnet\\' } | Select-String -Pattern '"tfm":\s*"net6' -List | ForEach-Object { ($_.Path -split '\\')[0..2] -join '\' } | Sort-Object -Unique

5. Yes, and that's also Microsoft's own position. An app is not exposed just because an affected .NET package is installed. It has to actually use Brotli decompression through .NET. With a clean tasklist you have a solid basis for marking it not applicable to the Celonis components, pending Celonis' written confirmation.

If you also want to close the Java side, there's one blind spot. Java libraries like brotli4j bundle the same native C decoder (fixed in 1.24.0) inside JAR files, where a normal file search can't see it. The script below scans the Celonis JARs, including nested ones. Save it as brotli-scan.ps1, set $Root on the first line, and run it after the tasklist check with powershell -NoProfile -ExecutionPolicy Bypass -File .\brotli-scan.ps1. Use Windows PowerShell rather than PowerShell 7, because in PowerShell 7 the scan itself loads that DLL. HIT means found, SKIP means that JAR couldn't be opened, and the last line shows how many JARs were checked.

$Root = 'C:\Program Files\Celonis'   # change to wherever your agents and extractors are installed
$pattern = 'brotli4j|jbrotli|org/brotli/|brotli[^/]*\.(dll|so|dylib)$'
Add-Type -AssemblyName System.IO.Compression
Add-Type -AssemblyName System.IO.Compression.FileSystem

function Find-Brotli($archive, $label) {
    foreach ($entry in $archive.Entries) {
        if ($entry.FullName -match $pattern) { "HIT   $label -> $($entry.FullName)" }
        if ($entry.FullName -like '*.jar') {
            try {
                $ms = New-Object System.IO.MemoryStream
                $s = $entry.Open(); $s.CopyTo($ms); $s.Dispose()
                $ms.Position = 0
                $inner = New-Object System.IO.Compression.ZipArchive($ms)
                try { Find-Brotli $inner "$label!$($entry.FullName)" } finally { $inner.Dispose() }
            } catch { "SKIP  could not read $label!$($entry.FullName)" }
        }
    }
}

if (-not (Test-Path -LiteralPath $Root)) { Write-Warning "path not found: $Root" }
$jars = @(Get-ChildItem -LiteralPath $Root -Recurse -Filter *.jar -File -ErrorAction SilentlyContinue)
foreach ($jar in $jars) {
    try {
        $zip = [System.IO.Compression.ZipFile]::OpenRead($jar.FullName)
        try { Find-Brotli $zip $jar.FullName } finally { $zip.Dispose() }
    } catch { "SKIP  could not read $($jar.FullName)" }
}
"$($jars.Count) jar files scanned under $Root"

If you get a HIT in a Celonis JAR, add that output to your support ticket rather than posting it here, because that changes the answer and is better handled privately. And if Edge WebView2 also comes up in your assessment (the OPC installer adds it), that's separate from .NET and gets patched through Edge updates.