Neat is rolling out Neat OS 26.6.3 to fix CVE-2026-111497, a memory-corruption bug in Google's open-source Brotli decoder that the US Cybersecurity and Infrastructure Security Agency (CISA) lists as actively exploited. The flaw affects every Neat device running an earlier release, because Neat OS uses the Brotli library in components that handle web content.
The staged Stable rollout began on November 7 and is due to finish by November 21, the company says, although it warns that the dates are subject to change. For some rooms the timing will depend on more than that window, because Neat now schedules Stable updates separately for each Neat Pulse organization, and devices with automatic updates switched off will stay on their current release.
For IT teams that manage Neat Bars, Boards and Pads, the time left before November 21 is a chance to confirm which devices already have the new release, which are waiting for a Pulse slot and which will need someone to step in.
An exploited bug and an interim advisory
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, based on evidence of active exploitation. Under the catalog entry, US federal civilian agencies had until November 10 to act, a deadline that passed 11 days before Neat expects its own rollout to complete.
Neat says it has no evidence of exploitation against Neat devices or customers. The KEV entry covers Google's Brotli library itself, which is bundled into browsers, runtimes and libraries across the industry, so it shows that the bug is being exploited somewhere without pointing to meeting-room hardware in particular. Even so, the listing gives admins good reason to treat the flaw as a practical risk, and Neat notes that proof-of-concept code is public.
Neat published its advisory on November 2 and has not updated it since, so it is still marked "Interim: fix in progress" and still refers to the fix as planned, even though the company says the fixed release reached its Stable channel on November 7. Neat has said it will update the advisory when the fix is available, so admins may want to check it again before closing the issue.
How serious the flaw is
Neat rates the issue High, with a CVSS v3.1 base score of 8.1, on the grounds that attack complexity is high because an attacker must deliver a precisely crafted data stream. NIST's analysts score the same CVE at 9.8, or Critical, with low attack complexity, and Google's CVSS v4.0 score is 9.2. The gap comes down to that attack-complexity judgment, since Neat's own scoring agrees that the impact would be severe and rates the bug as harder to trigger.
Neat argues that on its own hardware the exposure is narrow. The vulnerable library is used by the Chromium WebView component, and Neat identifies the Neat Browser (Neat Open Apps) and captive portal handling as the two exposed paths, because both process content from outside the customer's control. Rooms on open or guest Wi-Fi face higher exposure, while devices on WPA2- or WPA3-Enterprise with server certificate validation face a much lower captive portal risk. Neat says it will reassess its rating if it sees exploitation against its devices or if reliable exploit code for these components becomes public.
How the update reaches devices
Stable releases no longer reach every customer at once, Neat explains. Each Pulse organization is given its own date, which appears in the Pulse portal under Updates, then Neat OS Roadmap. Neat gives November 21 as the completion date for the rollout but has not said whether that covers every Pulse tenant's schedule.
Devices outside Pulse update overnight, provided they are powered on, online and set to the Stable channel with automatic updates enabled. A device on which automatic updates have been disabled will stay on its current release until someone switches them back on under System Settings, System, Software Update. On Pulse-enrolled devices that option is grayed out, and updates are managed in Pulse instead.
What admins should check now
The first step is to confirm the Neat OS version on every device, either in Pulse or under System Settings, System, About, and to flag anything below 26.6.3. Pulse customers can then check the roadmap to see when their organization's update is scheduled, and if it falls late in the window, the interim mitigations become more important.
It is also worth identifying devices with automatic updates turned off, because they will not receive the release until the setting is changed. In the meantime, Neat recommends making sure devices already carry its eMudhra certificate fix in Neat OS 26.5.4 (Stable) or 26.6.1 (Preview), keeping devices off captive portals, holding off on the Neat Browser where it is not needed and restricting it to trusted sites where it is, and segmenting the network. Neat says these steps reduce exposure, although the vulnerability remains until the update is installed.
Those checks also need someone to own them, and UC Today has reported that connected meeting-room devices often fall between IT, facilities and AV teams, with no single function clearly responsible for them. For organizations in that position, agreeing who will check the Neat estate before November 21 is a sensible place to start, so that every device is either updated or covered by Neat's interim mitigations when the rollout window closes.
