VMSA-2026-0008: Critical SDDC Manager RCE (CVE-2026-111497) — Workarounds Available, Patches Pending

Critical security alert for VMware Cloud Foundation (VCF) and VMware vSphere Foundation (VVF) administrators: Broadcom has published VMSA-2026-0008, describing a remote code execution vulnerability in SDDC Manager. The official response matrix explicitly lists both VCF and VVF for affected 9.x releases; VCF 5.2.x is listed separately. The issue, tracked as CVE-2026-111497, stems from an out-of-bounds write in the Node.js Brotli decoder.

The highest-risk exposure is SDDC Manager 9.1.1.x: Critical, CVSSv3 9.8. Affected older releases — 5.2.x, 9.0.x, and 9.1.0 — are rated Important, CVSSv3 7.5. Broadcom has published separate manual workarounds; patches remain pending for all affected SDDC Manager releases as of October 28, 2026.

October 28 portfolio-wide update: Broadcom’s new KB 460791, titled Node.js Brotli decoder vulnerability, CVE-2026-111497, and VMware by Broadcom product portfolio, reports a review of the wider VMware product portfolio and states that no other VMware product is critically affected beyond SDDC Manager in VCF 9.1.1. This is not the same as saying every other release is unaffected: VMSA-2026-0008 continues to rate older SDDC Manager releases 7.5 (Important), and its detailed response matrix explicitly includes VVF 9.x alongside VCF 9.x.

Below is the version-specific action plan, an explanation of what the vulnerability means, and the safeguards administrators should verify before and after applying the vendor’s interim procedures.

Immediate action: identify your SDDC Manager version

Affected product	SDDC Manager release	CVSSv3	Severity	Vendor workaround	Fixed version
VCF and VVF	9.1.1 (including the 9.1.1.x release family)	9.8	Critical	Broadcom KB 460732	Patch pending
VCF and VVF	9.1.0	7.5	Important	Broadcom KB 460734	Patch pending
VCF and VVF	9.0.x	7.5	Important	Broadcom KB 460734	Patch pending
VCF only	5.2.x	7.5	Important	Broadcom KB 460734	Patch pending

Important product distinction for VVF customers: The official Broadcom VMSA-2026-0008 response matrix names VMware Cloud Foundation and VMware vSphere Foundation together for SDDC Manager 9.1.1 and 9.0.x/9.1.0. Its separate 5.2.x row identifies VCF only. Although the advisory’s short top-level impacted-products list mentions VCF, the more detailed response matrix explicitly includes VVF in 9.x; VVF administrators should not assume the issue is VCF-only.

Important workaround-build distinction: KB 460734 specifically names SDDC Manager 5.2.4, 9.0.2, and 9.1.0 in its procedure. If you are on another affected 5.2.x or 9.0.x build, confirm applicability with Broadcom Support before changing the appliance.

Official sources: VMSA-2026-0008 — Broadcom Security Advisory and Broadcom KB 460791 — VMware product-portfolio assessment (updated October 28, 2026).

New Broadcom portfolio-wide assessment: KB 460791 (October 28)

Broadcom’s KB 460791 documents a VMware-wide review of CVE-2026-111497, rather than only the product-specific workarounds in KB 460732 and KB 460734. Its Resolution identifies SDDC Manager in VCF 9.1.1 as the only critically affected VMware by Broadcom product. The article’s Environment and Products sections identify the following areas as within the review’s scope:

• VCF and VVF: components and add-ons across 5.2.x and 9.x; see the VCF 5.2.4 and 9.1.1 bills of materials for component lists
• VMware Cloud Director and VMware Remote Console
• VMware HCX and PowerCLI
• VMware Telco Cloud Platform
• VMware Workstation and VMware Fusion

How to interpret the assessment: “Not critically affected” is a severity-scope statement, not a blanket “not vulnerable” determination for every version or deployment. This is especially important for SDDC Manager 9.0.x, 9.1.0, and 5.2.x, which remain explicitly affected at CVSS 7.5 (Important) in the VMSA response matrix. KB 460791 summarizes the Critical finding as “SDDC Manager in VCF 9.1.1”; the more detailed VMSA matrix lists both VCF and VVF for affected 9.x SDDC Manager releases. This portfolio assessment does not replace the product-version-specific mitigation and patch guidance in the VMSA.

What is CVE-2026-111497?

Brotli is a compression format used by web services and applications to reduce data size. Node.js includes support for decompressing Brotli-encoded content. CVE-2026-111497 concerns an out-of-bounds write in that decoder: specially crafted compressed input can cause the decoder to write outside an intended memory boundary.

Memory corruption of this kind can potentially cause a process crash or enable arbitrary code execution, depending on the affected application and exploit conditions. For SDDC Manager, Broadcom specifically identifies a remote code execution attack path: a malicious actor with network access to the appliance may exploit the issue to execute arbitrary code.

Why care beyond the CVSS number? SDDC Manager is a high-value management and lifecycle component in a VCF environment. A compromise of a management appliance warrants serious attention even where its interfaces are isolated from the public internet. Administrators should assess reachable management networks, not merely whether a service is directly internet-facing.

Why 9.8 on SDDC Manager 9.1.1.x, but 7.5 on earlier versions?

Broadcom explicitly distinguishes SDDC Manager 9.1.1.x from earlier affected releases in its advisory. The published CVSSv3 vectors show why:

SDDC Manager 9.1.1.x: Critical, CVSSv3 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vector specifies network attack access, low attack complexity, no privileges required, no user interaction required, and high potential impact on confidentiality, integrity, and availability.

SDDC Manager 5.2.x, 9.0.x, and 9.1.0: Important, CVSSv3 7.5

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

For these releases, the vector specifies adjacent-network attack access and high attack complexity, rather than the network/low-complexity combination associated with 9.1.1.x. The potential impact ratings remain high. A 7.5 score is not a reason to defer assessment indefinitely.

Manual workaround: SDDC Manager 9.1.1.x

Use: Broadcom KB 460732 — Manual interim workaround for CVE-2026-111497 (Brotli) on SDDC Manager 9.1.1.x.

This procedure applies to SDDC Manager 9.1.1 and 9.1.1 EP and uses two complementary controls:

1. nginx request filtering on the HTTPS path: A rule detects requests declaring Brotli compression using Content-Encoding: br and rejects them with HTTP 415, before forwarding them to the UI application.
2. UI application protection for the direct local path: The procedure also modifies the SDDC Manager UI server to reject Brotli-encoded request bodies before its request parsers process them. This closes the gap where requests could reach the local UI service without traversing nginx.

Broadcom instructs administrators to back up the SDDC Manager appliance and affected files first, test the nginx configuration, reload nginx, restart sddc-manager-ui-app, and run verification requests against both access paths.

What successful verification looks like: Brotli-encoded request-body tests return 415 on both the nginx and direct UI paths, while ordinary requests are not incorrectly rejected by the Brotli-specific rule. If validation fails, Broadcom provides rollback steps and directs administrators to contact Global Support.

Do not implement only half of this workaround: both the nginx rule and the UI-server check are part of the vendor’s documented mitigation for 9.1.1.x. Follow the current KB instructions in full rather than treating this summary as a command-by-command replacement.

Manual workaround: SDDC Manager 5.2.x, 9.0.x, and 9.1.0

Use: Broadcom KB 460734 — Manual interim workaround for CVE-2026-111497 (Brotli) on SDDC Manager 5.2.4, 9.0.2, and 9.1.0.

These releases use a different mitigation mechanism. Broadcom documents a Node.js preload module that removes the zlib.createBrotliDecompress function used by the UI application’s HTTP client to handle Brotli. The preload is introduced through the NODE_OPTIONS environment setting in the sddc-manager-ui-app systemd service.

After applying the modification, administrators reload systemd and restart the UI application. Broadcom’s checks include confirming the environment variable is loaded, verifying the UI and its Inventory and Domains pages still function, and reviewing the service journal for Brotli-related or decompression errors.

The KB also includes explicit rollback instructions if the UI does not function as expected.

Do not substitute the 9.1.1 nginx/UI-code procedure for the older-version Node.js preload procedure. Match the method to the actual release and follow Broadcom’s supported directions.

What administrators should do now

1. Inventory affected appliances. Include both VCF and VVF 9.x deployments, plus VCF 5.2.x, when checking affected SDDC Manager versions across production, secondary, lab, and disaster-recovery environments.
2. Prioritize 9.1.1.x. Review the Critical 9.8 exposure promptly, while still tracking and mitigating affected 7.5-rated releases.
3. Restrict management-plane reachability. Assess who and what can access SDDC Manager services; restrict exposure to trusted administrative networks and required systems where feasible.
4. Prepare a documented change. Back up the appliance and specified files, assess service restart implications, and preserve a tested rollback path.
5. Apply the correct interim workaround. Use KB 460732 for 9.1.1.x or KB 460734 for the documented earlier releases.
6. Validate, don’t assume. Follow the KB’s functional tests, service checks, and rejection tests, as appropriate to your version.
7. Track official fixes. The published response matrix lists the fixed versions as patch pending. Revisit the advisory and plan to move to Broadcom-supported fixed releases once published, following vendor guidance on interim modifications.

Does this advisory also affect vCenter, ESXi, NSX, or other VCF components?

VMSA-2026-0008 identifies SDDC Manager as the affected component in VCF and VVF 9.x as well as VCF 5.2.x. Separately, Broadcom’s portfolio review (KB 460791) includes VCF/VVF components and add-ons and states that no other VMware by Broadcom product is critically affected by this CVE. The review supplies broader vendor context without changing the confirmed 9.8/7.5 SDDC Manager release matrix.

Do not confuse “not critically affected” with “not vulnerable.” KB 460791 does not provide an individual version-by-version CVE outcome for every listed component or product. The VMSA does not list vCenter Server, ESXi, NSX, or other individual VCF components as separate affected entries. For product-specific applicability and operational decisions, rely on the vendor’s explicit findings and any subsequent product advisory, rather than extrapolating from bundled Node.js or Brotli alone.

Final thoughts: mitigations exist, even though patches are pending

This is a management-plane vulnerability with a confirmed remote code execution impact, an especially serious 9.8 Critical rating for SDDC Manager 9.1.1.x, and official interim workarounds that differ across release families.

The practical takeaway: know the version, evaluate management-network exposure, execute the correct Broadcom procedure, verify the outcome, and keep watching for a fixed release. Waiting for the patch should not mean waiting to assess risk.

We’ll continue following the vendor advisory and update this article if Broadcom publishes fixed builds, revised mitigation instructions, or other material technical guidance.

Official references

• Broadcom Security Advisory VMSA-2026-0008
• Broadcom KB 460791 — VMware by Broadcom portfolio-wide CVE-2026-111497 assessment (updated October 28, 2026)
• Broadcom KB 460732 — SDDC Manager 9.1.1.x mitigation
• Broadcom KB 460734 — SDDC Manager 5.2.4 / 9.0.2 / 9.1.0 mitigation

Broader ecosystem context: confirmed advisories from other vendors

Context only — not an expansion of the VMware affected-products list. CVE-2026-111497 affects a Brotli decompression implementation that is used beyond SDDC Manager. The following vendors have independently documented their own product exposure or remediation. Their notices do not establish that any additional VMware, VCF, VVF, or other Broadcom product is vulnerable; use the relevant vendor’s product-specific advisory for applicability.

• Palo Alto Networks: Its CVE-2026-111497 portfolio advisory identifies applicable PAN-OS versions and configurations involving Brotli inspection and TLS/SSL decryption, alongside the Prisma Cloud Application Security Transporter Client. Consult its current matrix for affected releases, mitigations, and patch availability.
• Microsoft .NET: Microsoft’s .NET Brotli decoder security advisory documents affected runtime/package versions and patched updates for .NET 8, 9, 10, and 11 prereleases. Exposure depends on processing attacker-controlled Brotli data; simply having .NET installed does not establish an exploitable path. .NET Framework is not affected.
• Retool: Retool’s product security disclosure explains a documented remote code execution path through crafted Brotli-compressed HTTP responses. Retool Cloud has been patched; affected self-hosted deployments should upgrade to a fixed build (4.34.12+ or 4.0.25+, as applicable).

These independent advisories demonstrate why teams should evaluate embedded libraries and reachable decompression paths in their own application portfolios. The operational guidance and affected-version table in this article remain specific to Broadcom’s SDDC Manager advisory for VCF/VVF.

October 27, 2026 — scope clarification: Explicitly identified VMware vSphere Foundation (VVF) 9.x in the affected-product table and introduction, reflecting the VCF/VVF rows of Broadcom’s published VMSA-2026-0008 response matrix. The 5.2.x row applies to VCF only. No fixed release is listed yet.

October 28, 2026 — portfolio assessment: Added Broadcom KB 460791, Broadcom’s VMware-wide CVE-2026-111497 product-portfolio review, and clarified the distinction between its “not critically affected” conclusion for other VMware products and the explicitly affected 7.5-rated older SDDC Manager releases. Broadcom’s KB was supplied for review with its October 28 update date; the linked Broadcom page may require an authenticated session to display its full text.

Last reviewed October 28, 2026. Security advisories, workarounds, and patch status can change; consult Broadcom’s latest documentation before making production changes.