When a widely reported vulnerability or security incident affects common software, our Security team assesses PandaDoc’s product, cloud infrastructure, and underlying services. This page shares the results and is updated as remediation progresses. The most recent bulletins appear first.
Security Advisory Update: Critical Unauthenticated RCE in GitLab (CVE-2026-110264)
Status: Not Affected / Zero Exposure
Customer impact: No customer impact
Customer action required: None
Last updated: October 26, 2026
Following the public disclosure of the critical GitLab Remote Code Execution vulnerability (CVE-2026-110264), our Security team conducted an infrastructure assessment.
Platform Status: Not Impacted. PandaDoc does not host self-managed GitLab instances or rely on GitLab application software within our production stack or platform architecture.
Security & Data Integrity: Our core platform and customer environment remain completely unaffected.
Customer Action Required: None.
If your security or compliance team requires additional technical details, please contact our Support team.
Security Advisory Update: Railway Platform Breach
Status: Not Affected / Zero Exposure
Customer impact: No customer impact
Customer action required: None
Last updated: October 26, 2026
Our Security team has evaluated our platform and supply chain following the security disclosure from cloud provider Railway regarding stored environment variables.
Platform Status: Not Affected. PandaDoc does not host services, manage environment variables, or store production credentials within Railway infrastructure.
Security & Data Integrity: Our production stack, internal APIs, and customer data environments remain completely unaffected.
Customer Action Required: None.
If your security or compliance team requires additional technical details, please contact our Support team.
Status Update - Security Advisory Update: Brotli Decoder Out-of-Bounds Write Enables RCE (CVE-2026-111497)
Status: Status: Remediation Complete / Fully Patched
Customer impact: No customer impact
Customer action required: None
Last updated: November 6, 2026
Following the recent industry-wide security advisory concerning the Brotli decompression library (CVE-2026-111497), our Security and Infrastructure Engineering teams have completed our remediation protocol.
Resolution Summary:
Remediation Status: Complete. Patched upstream library releases and updated runtime dependencies have been fully deployed and verified across all production environments, container workloads, and edge routing services.
Security & Integrity: Telemetry from our runtime protection systems, Web Application Firewalls (WAF), and perimeter logging confirms zero evidence of exploitation attempts, anomalies, or platform compromise.
Customer Action Required: None. All patches were applied natively within our managed cloud infrastructure without service interruption.
If your security or compliance team requires additional technical details, please contact our Support team.
Previous update:
Security Advisory Update: Brotli Decoder Out-of-Bounds Write Enables RCE (CVE-2026-111497)
Status: Active remediation
Customer impact: No customer impact
Customer action required: None
Last updated: October 24, 2026
Our Security team is actively addressing the industry-wide security advisory concerning the Brotli decompression library (CVE-2026-111497), so far dubbed Broccoli2Shell, Node2Shell, and HTTP2Shell, among other names.
Platform Status: In accordance with our security patch management policy, updated vendor libraries are undergoing validation and expedited deployment across our cloud environments.
Security & Integrity: Perimeter defenses and runtime anomaly detection show zero impact to our services, customer data, or platform availability.
Customer Action Required: None. All updates are applied directly by our engineering teams within our managed cloud infrastructure.
If your security or compliance team requires additional technical details, please contact our Support team.
Security Advisory Update: eMudhra Certificate Authority Revocation (CVE-2026-111943)
Status: Dependency updates in deployment
Customer impact: No customer impact
Customer action required: None
Last updated: October 24, 2026
Our Security team has evaluated our platform following the public disclosure of revoked intermediate certificates associated with eMudhra.
Active Dependency Upgrades: Certain runtime components and platform dependencies bundle their own internal certificate trust stores. Our engineering teams have validated patched releases of these dependencies and are actively deploying updated versions across our cloud infrastructure to enforce the distrust of all affected eMudhra intermediate certificates.
Zero Impact to Service & Data: Continuous TLS telemetry, network monitoring, and runtime threat detection confirm zero evidence of unauthorized traffic interception, MITM activity, or platform compromise.
Customer Action Required: None. All dependency patches, runtime updates, and infrastructure changes are managed transparently by our team with no service interruption or action required on your part.
If your security or compliance team requires additional technical details, please contact our Support team.
Security Advisory Update: PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Status: Not affected
Customer impact: No customer impact
Customer action required: None
Last updated: October 23, 2026
Our Security team has completed an assessment of our product, cloud infrastructure, and underlying services. The PandaDoc application is not vulnerable to or affected by these issues. Our production environments do not use vulnerable PHP runtime components, and comprehensive infrastructure vulnerability scans show zero exposure across our systems.
If your security or compliance team requires additional technical details, please contact our Support team.
You can read about PandaDoc’s certifications and security practices on our security page.