Broadcom published VMSA-2026-0008 on 27 October and updated it the next day. It covers one flaw, CVE-2026-111497, and one component, SDDC Manager. As of 7 November there is still no fixed build for any version. Every row in the advisory's response matrix says "Patch pending". What exists is a workaround, and it is manual. The same day Broadcom published, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue. That is the line that should move this up your list. It means someone has evidence of the flaw being used, not just a proof of concept. ## What the flaw actually is SDDC Manager's UI runs on a bundled Node.js runtime, and that runtime includes Google's Brotli decoder. CVE-2026-111497 is an out-of-bounds write in the decoder. A request that arrives with a Brotli-compressed body, `Content-Encoding: br`, can be crafted to write outside the buffer it was given. That is the path to remote code execution, which is why the 9.1.1 rating is what it is. Broadcom's portfolio article, KB 460791, checks the rest of the stack: vCenter, NSX, VCF Operations, HCX, Cloud Director, PowerCLI and the desktop products all appear in it. Its conclusion is that SDDC Manager on 9.1.1 is the only place the flaw is rated critical. ## How bad it is depends on your version SDDC Manager| CVSSv3| Severity| Fixed version| Workaround ---|---|---|---|--- 9.1.1 (including EP)| 9.8| Critical| Patch pending| KB 460732 9.0.x and 9.1.0| 7.5| Important| Patch pending| KB 460734 5.2.x| 7.5| Important| Patch pending| KB 460734 The uncomfortable part is the top row. Plenty of teams moved to 9.1.1 because it was the current release, and they now have the highest score of anyone. If you are midway through the staged path from 9.0 or 5.2, it does not change the plan, but it does mean the workaround has to be applied on whichever SDDC Manager you are running today, not the one you are heading to. ## What the workaround does For 9.1.1 the workaround tells nginx in front of the SDDC Manager UI to refuse any request body that declares Brotli encoding. Brotli is the only encoding the CVE affects, so legitimate traffic carries on. The KB offers it two ways: a script with `check`, `apply` and `rollback` commands, or the same change by hand. Before either, the KB asks for three things, and they are worth taking seriously: * A backup or snapshot of the SDDC Manager appliance first. * No SDDC Manager task in flight. No upgrade, no workload domain operation, no certificate replacement. * Root on the appliance, so this goes through whoever owns SSH access to it, and probably through a change record. Run `check` before `apply`. It changes nothing and tells you whether the UI is healthy and whether the workaround is already in place. If you apply the change by hand, roll it back by hand: the script will refuse to undo a manual change. Broadcom is explicit that this is temporary and only covers this one CVE. When the patched build arrives, the patch is the fix and the nginx rule comes out. ## What I would do this week 1. Find out which SDDC Manager version each instance is on. If you run more than one VCF instance, they may not match. 2. Check who can reach the SDDC Manager UI on 443. In most estates it sits on a management network, and that is your main mitigation until the workaround is in. If it is reachable from a general user network, that is the first thing to fix. 3. Take the backup, confirm it actually wrote something, then apply the workaround from the right KB for your version. 4. Write down that the workaround is in place and where. When the patch ships, someone has to remember to remove it, and that person may not be you. 5. Subscribe to VMSA-2026-0008 on the Broadcom support portal so you see the update when the fixed builds are published. Step three is not padding. NSX has its own open issue at the moment, KB 459284, where a backup reports success and writes empty files when the SFTP target is full. Different product, same lesson: the green tick is not the evidence. If you want a structured way to check what you could actually restore, the Restore Evidence Check walks through it. ## Sources * VMSA-2026-0008.1, Broadcom, updated 28 October 2026 * KB 460791: CVE-2026-111497 and the VMware by Broadcom product portfolio * KB 460732: manual interim workaround on SDDC Manager 9.1.1.x * KB 460734: manual interim workaround on SDDC Manager 5.2.4, 9.0.2 and 9.1.0 * KB 459284: NSX backup reports success with 0-byte files * CISA adds two known exploited vulnerabilities to catalog, 27 October 2026 Checked against Broadcom's advisory and KBs on 7 November 2026. Views are my own. More on VCF This is one of the VCF pieces here. The rest are grouped by problem rather than by date on the VCF index, which is the fastest way to find the one you actually need. Eight free planning tools run in your browser, with nothing sent anywhere. They are all on the tools page, from Estate Readiness Triage to the Restore Evidence Check.

If you run VMware Cloud Foundation, check your SDDC Manager version and get the appropriate workaround into your change process. Broadcom's VMSA-2026-0008.1 addresses CVE-2026-111497, a remote code execution vulnerability in the Node.js Brotli decoder used by SDDC Manager. The highest severity applies to SDDC Manager 9.1.1.x: Critical, CVSSv3 9.8. The affected older releases listed in the advisory are rated…

Groups Conversations All groups and messages Sign in Technical - Security - Patch Management Conversations About Privacy • Terms     Broadcom Security Advisories (VMSA-2026-0008) 0 views Eyal Estrin unread, 12:48 AM (19 minutes ago)    to https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39445 Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

TL;DR Broadcom has issued VMSA-2026-0008 for a critical VMware SDDC Manager vulnerability, tracked as CVE-2026-111497. The flaw scores 9.8 on CVSS v3 in SDDC Manager 9.1.1. It stems from the same Brotli vulnerability that CISA added to its KEV catalog on October 27. A bug in the Node.js Brotli decoder lets attackers run code on SDDC Manager. Patches are still pending, but Broadcom offers workarounds.

Broadcom patched two VMware Workstation/Fusion VM-escape bugs. No workarounds exist. Update to version 26H1u1 immediately.