VMSA-2026-0008: Critical SDDC Manager RCE (CVE-2026-111497) — Workarounds Available, Patches Pending
Critical security alert for VMware Cloud Foundation (VCF) and VMware vSphere Foundation (VVF) administrators: Broadcom has published VMSA-2026-0008, describing a remote code execution vulnerability in SDDC Manager. The official response matrix explicitly lists both VCF and VVF for affected 9.x releases; VCF 5.2.x is listed separately. The issue, tracked as CVE-2026-111497, stems from an out-of-bounds write in the Node.js Brotli decoder.
The highest-risk exposure is SDDC Manager 9.1.1.x: Critical, CVSSv3 9.8. Affected older releases — 5.2.x, 9.0.x, and 9.1.0 — are rated Important, CVSSv3 7.5. Broadcom has published separate manual workarounds; patches are still pending for all listed versions as of October 27, 2026.
Below is the version-specific action plan, an explanation of what the vulnerability means, and the safeguards administrators should verify before and after applying the vendor’s interim procedures.
Immediate action: identify your SDDC Manager version
| Affected product | SDDC Manager release | CVSSv3 | Severity | Vendor workaround | Fixed version |
|---|---|---|---|---|---|
| VCF and VVF | 9.1.1 (including the 9.1.1.x release family) | 9.8 | Critical | Broadcom KB 460732 | Patch pending |
| VCF and VVF | 9.1.0 | 7.5 | Important | Broadcom KB 460734 | Patch pending |
| VCF and VVF | 9.0.x | 7.5 | Important | Broadcom KB 460734 | Patch pending |
| VCF only | 5.2.x | 7.5 | Important | Broadcom KB 460734 | Patch pending |
Important product distinction for VVF customers: The official Broadcom VMSA-2026-0008 response matrix names VMware Cloud Foundation and VMware vSphere Foundation together for SDDC Manager 9.1.1 and 9.0.x/9.1.0. Its separate 5.2.x row identifies VCF only. Although the advisory’s short top-level impacted-products list mentions VCF, the more detailed response matrix explicitly includes VVF in 9.x; VVF administrators should not assume the issue is VCF-only.
Important workaround-build distinction: KB 460734 specifically names SDDC Manager 5.2.4, 9.0.2, and 9.1.0 in its procedure. If you are on another affected 5.2.x or 9.0.x build, confirm applicability with Broadcom Support before changing the appliance.
Official source: VMSA-2026-0008 — Broadcom Security Advisory.
What is CVE-2026-111497?
Brotli is a compression format used by web services and applications to reduce data size. Node.js includes support for decompressing Brotli-encoded content. CVE-2026-111497 concerns an out-of-bounds write in that decoder: specially crafted compressed input can cause the decoder to write outside an intended memory boundary.
Memory corruption of this kind can potentially cause a process crash or enable arbitrary code execution, depending on the affected application and exploit conditions. For SDDC Manager, Broadcom specifically identifies a remote code execution attack path: a malicious actor with network access to the appliance may exploit the issue to execute arbitrary code.
Why care beyond the CVSS number? SDDC Manager is a high-value management and lifecycle component in a VCF environment. A compromise of a management appliance warrants serious attention even where its interfaces are isolated from the public internet. Administrators should assess reachable management networks, not merely whether a service is directly internet-facing.
Why 9.8 on SDDC Manager 9.1.1.x, but 7.5 on earlier versions?
Broadcom explicitly distinguishes SDDC Manager 9.1.1.x from earlier affected releases in its advisory. The published CVSSv3 vectors show why:
SDDC Manager 9.1.1.x: Critical, CVSSv3 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The vector specifies network attack access, low attack complexity, no privileges required, no user interaction required, and high potential impact on confidentiality, integrity, and availability.
SDDC Manager 5.2.x, 9.0.x, and 9.1.0: Important, CVSSv3 7.5
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
For these releases, the vector specifies adjacent-network attack access and high attack complexity, rather than the network/low-complexity combination associated with 9.1.1.x. The potential impact ratings remain high. A 7.5 score is not a reason to defer assessment indefinitely.
Manual workaround: SDDC Manager 9.1.1.x
Use: Broadcom KB 460732 — Manual interim workaround for CVE-2026-111497 (Brotli) on SDDC Manager 9.1.1.x.
This procedure applies to SDDC Manager 9.1.1 and 9.1.1 EP and uses two complementary controls:
- nginx request filtering on the HTTPS path: A rule detects requests declaring Brotli compression using
Content-Encoding: brand rejects them with HTTP415, before forwarding them to the UI application. - UI application protection for the direct local path: The procedure also modifies the SDDC Manager UI server to reject Brotli-encoded request bodies before its request parsers process them. This closes the gap where requests could reach the local UI service without traversing nginx.
Broadcom instructs administrators to back up the SDDC Manager appliance and affected files first, test the nginx configuration, reload nginx, restart sddc-manager-ui-app, and run verification requests against both access paths.
What successful verification looks like: Brotli-encoded request-body tests return 415 on both the nginx and direct UI paths, while ordinary requests are not incorrectly rejected by the Brotli-specific rule. If validation fails, Broadcom provides rollback steps and directs administrators to contact Global Support.
Do not implement only half of this workaround: both the nginx rule and the UI-server check are part of the vendor’s documented mitigation for 9.1.1.x. Follow the current KB instructions in full rather than treating this summary as a command-by-command replacement.
Manual workaround: SDDC Manager 5.2.x, 9.0.x, and 9.1.0
These releases use a different mitigation mechanism. Broadcom documents a Node.js preload module that removes the zlib.createBrotliDecompress function used by the UI application’s HTTP client to handle Brotli. The preload is introduced through the NODE_OPTIONS environment setting in the sddc-manager-ui-app systemd service.
After applying the modification, administrators reload systemd and restart the UI application. Broadcom’s checks include confirming the environment variable is loaded, verifying the UI and its Inventory and Domains pages still function, and reviewing the service journal for Brotli-related or decompression errors.
The KB also includes explicit rollback instructions if the UI does not function as expected.
Do not substitute the 9.1.1 nginx/UI-code procedure for the older-version Node.js preload procedure. Match the method to the actual release and follow Broadcom’s supported directions.
What administrators should do now
- Inventory affected appliances. Include both VCF and VVF 9.x deployments, plus VCF 5.2.x, when checking affected SDDC Manager versions across production, secondary, lab, and disaster-recovery environments.
- Prioritize 9.1.1.x. Review the Critical 9.8 exposure promptly, while still tracking and mitigating affected 7.5-rated releases.
- Restrict management-plane reachability. Assess who and what can access SDDC Manager services; restrict exposure to trusted administrative networks and required systems where feasible.
- Prepare a documented change. Back up the appliance and specified files, assess service restart implications, and preserve a tested rollback path.
- Apply the correct interim workaround. Use KB 460732 for 9.1.1.x or KB 460734 for the documented earlier releases.
- Validate, don’t assume. Follow the KB’s functional tests, service checks, and rejection tests, as appropriate to your version.
- Track official fixes. The published response matrix lists the fixed versions as patch pending. Revisit the advisory and plan to move to Broadcom-supported fixed releases once published, following vendor guidance on interim modifications.
Does this advisory also affect vCenter, ESXi, NSX, or other VCF components?
VMSA-2026-0008 identifies SDDC Manager as the affected component in VCF and VVF 9.x as well as VCF 5.2.x. This is a product-scope clarification, not a claim that vCenter Server, ESXi, NSX, or other individual components are separately affected by this particular CVE. Those components are not individually listed as affected components in this VMSA response matrix.
That does not amount to an independent guarantee that every other product or Node.js deployment is free of the underlying upstream Brotli issue. Treat separate products according to their own applicable security advisories and vendor disclosures, rather than extending this SDDC Manager finding without evidence.
Final thoughts: mitigations exist, even though patches are pending
This is a management-plane vulnerability with a confirmed remote code execution impact, an especially serious 9.8 Critical rating for SDDC Manager 9.1.1.x, and official interim workarounds that differ across release families.
The practical takeaway: know the version, evaluate management-network exposure, execute the correct Broadcom procedure, verify the outcome, and keep watching for a fixed release. Waiting for the patch should not mean waiting to assess risk.
We’ll continue following the vendor advisory and update this article if Broadcom publishes fixed builds, revised mitigation instructions, or other material technical guidance.
Official references
- Broadcom Security Advisory VMSA-2026-0008
- Broadcom KB 460732 — SDDC Manager 9.1.1.x mitigation
- Broadcom KB 460734 — SDDC Manager 5.2.4 / 9.0.2 / 9.1.0 mitigation
Broader ecosystem context: confirmed advisories from other vendors
Context only — not an expansion of the VMware affected-products list. CVE-2026-111497 affects a Brotli decompression implementation that is used beyond SDDC Manager. The following vendors have independently documented their own product exposure or remediation. Their notices do not establish that any additional VMware, VCF, VVF, or other Broadcom product is vulnerable; use the relevant vendor’s product-specific advisory for applicability.
- Palo Alto Networks: Its CVE-2026-111497 portfolio advisory identifies applicable PAN-OS versions and configurations involving Brotli inspection and TLS/SSL decryption, alongside the Prisma Cloud Application Security Transporter Client. Consult its current matrix for affected releases, mitigations, and patch availability.
- Microsoft .NET: Microsoft’s .NET Brotli decoder security advisory documents affected runtime/package versions and patched updates for .NET 8, 9, 10, and 11 prereleases. Exposure depends on processing attacker-controlled Brotli data; simply having .NET installed does not establish an exploitable path. .NET Framework is not affected.
- Retool: Retool’s product security disclosure explains a documented remote code execution path through crafted Brotli-compressed HTTP responses. Retool Cloud has been patched; affected self-hosted deployments should upgrade to a fixed build (4.34.12+ or 4.0.25+, as applicable).
These independent advisories demonstrate why teams should evaluate embedded libraries and reachable decompression paths in their own application portfolios. The operational guidance and affected-version table in this article remain specific to Broadcom’s SDDC Manager advisory for VCF/VVF.
October 27, 2026 — scope clarification: Explicitly identified VMware vSphere Foundation (VVF) 9.x in the affected-product table and introduction, reflecting the VCF/VVF rows of Broadcom’s published VMSA-2026-0008 response matrix. The 5.2.x row applies to VCF only. No fixed release is listed yet.
Last reviewed October 27, 2026. Security advisories, workarounds, and patch status can change; consult Broadcom’s latest documentation before making production changes.
