TL;DR Broadcom has issued VMSA-2026-0008 for a critical VMware SDDC Manager vulnerability, tracked as CVE-2026-111497. The flaw scores 9.8 on CVSS v3 in SDDC Manager 9.1.1. It stems from the same Brotli vulnerability that CISA added to its KEV catalog on October 27. A bug in the Node.js Brotli decoder lets attackers run code on SDDC Manager. Patches are still pending, but Broadcom offers workarounds.