VMSA-2026-0008.1 — Apply KB 460732 on 9.1.1 or KB 460734 on 5.2.x, 9.0.x and 9.1.0, keep SDDC Manager reachable only from trusted admin hosts, and subscribe to the advisory so you see the patch the day it lands.
The vsphere Terraform provider 2.18.0 arrived yesterday, and it's the release to look at if you manage Supervisor namespaces as code. vsphere_namespace gains zones, user and group permissions, per-policy storage limits, NSX VPC or vSphere network backing and import, there's a new Supervisor data source, and the retry_timeout fix for network lookups is in. It also swaps storage_policies for storage_policy blocks, so read the upgrade notes before you lift your version pin.
There's no new VMSA today, and SDDC Manager is still waiting for its Brotli patch, with the press-reported US federal deadline falling today.
At KubeCon, Broadcom has contributed its VM API to the CNCF Sandbox and validated more than 20 new partner solutions for VKS. William Lam shows how to check VCF download checksums by hand, Unexplored Territory talks to John Nicholson about the new VCF Readiness Assessment Tool, and today's deep dive walks through building vSphere Namespaces with the new provider release.
SecurityNo new VMSASDDC Manager's Brotli patch is still pending
Releases & KBsAll quietThe newest VCF 9.1.1 patch is still from 26 Oct
Terraform & Packervsphere 2.18.0 is outOne breaking change on vsphere_namespace
Next deadlineTodayFederal deadline for the Brotli flaw, per press
Key Takeaways
UrgentKeep the Brotli workaround on SDDC Manager, and get the ESX logging fix in by tomorrow.VMSA-2026-0008.1 still shows "Patch pending" for every SDDC Manager version, so KB 460732 on 9.1.1 (or KB 460734 on 5.2.x, 9.0.x and 9.1.0) is what's protecting you. Press reports put the US federal deadlines at today for the Brotli flaw and tomorrow, 11 November, for ESX CVE-2026-41709, whose fixed builds are in the VMSA-2026-0006 matrix.
Before upgradingRewrite storage_policies as storage_policy blocks before you move to vsphere provider 2.18.0.The 2.18.0 release replaces the attribute on vsphere_namespace and its data source, and PR #2789 says Terraform will fail at plan or apply on the old schema rather than change anything. Keep ~> 2.17 pinned until the namespace code is updated, then take the release for its new zone, permission and network options.
This monthIf you have Alpine-based jump hosts or containers running sshd, patch OpenSSH now.The "SSHole" flaw CVE-2026-123158 only affects musl-based builds with PAM disabled, Alpine's default server setup among them, per The Hacker News. Press reports say CISA added it to its KEV catalogue on 9 November with a 12 November federal deadline (tech-insider). Broadcom hasn't published a statement on it.
LabRun the free VCF Readiness Assessment Tool before you repurpose old servers for a VCF 9.1 lab.vmware/vcf-readiness reads each server's BMC over Redfish and reports CPU support against KB 428874, vSAN ESA and OSA readiness, TPM 2.0 state and Intel VMD settings, as John Nicholson explains on Unexplored Territory #130.
WatchKeep an eye on the VM API now that it's a CNCF Sandbox project.Broadcom's announcement describes it as a way to provision and manage VMs through Kubernetes APIs across providers. It changes nothing in VCF today, but it's the direction the VM Service and declarative VM management are heading.
Security Advisories Latest four
There's no new VMSA today, so these are the four most recently released or updated advisories; Broadcom's advisory portal has the rest. VMSA-2026-0008.1 still lists "Patch pending" for every SDDC Manager version, and vCenter CVE-2026-59310 in VMSA-2026-0006 remains the most important fix if you haven't applied it. Outside VMware, press reports say CISA added the OpenSSH "SSHole" flaw CVE-2026-123158 to its KEV catalogue on 9 November (tech-insider [Press]); it only affects musl-based systems with PAM disabled, per The Hacker News [Press]. Broadcom hasn't published a statement on it, or on the Linux kernel TCP flaw CVE-2026-98432.
Node.js, as used in SDDC Manager, has a Brotli decoder out-of-bounds write that an attacker with network access to SDDC Manager could use to run code. It is critical (9.8) on SDDC Manager 9.1.1 and important (7.5) on 9.0.x, 9.1.0 and 5.2.x; revision .1 on 28 Oct clarified the impacted products in the response matrix. Every fixed version in the matrix is still "Patch pending", and the only SDDC Manager 9.1.1 patch on TechDocs, 9.1.1.0200, doesn't mention it. Broadcom's portfolio statement KB 460791 says SDDC Manager in VCF 9.1.1 is the only critically affected product. Press reports say CISA added the underlying Brotli flaw to its KEV catalogue on 27 Oct with a federal deadline of 10 Nov, which is today; the Broadcom advisory itself makes no statement on exploitation. Issue date 27 Oct 2026.
CVE-2026-111497 9.8SDDC Manager Node.js Brotli · 9.8 on 9.1.1, 7.5 elsewhere · reported KEV 27 Oct
DoApply KB 460732 on 9.1.1 or KB 460734 on 5.2.x, 9.0.x and 9.1.0, keep SDDC Manager reachable only from trusted admin hosts, and subscribe to the advisory so you see the patch the day it lands.
For desktop hypervisors: Workstation 25H2 and 26H1 and Fusion 25H2 and 26H1, CVSSv3 8.1 to 9.3. Both CVEs need local admin rights inside a guest and can lead to code execution on the host. There are no workarounds and the advisory makes no statement on exploitation.
CVE-2026-59346 9.3VMXNET3 integer overflow
CVE-2026-59347 8.1HGFS stack overflow
DoUpdate Workstation and Fusion to 26H1u1, especially if you run nested labs on a laptop.
Still the one to prioritise. It covers vCenter, ESX, Workstation and Fusion (and so VCF, VVF and Telco Cloud), CVSSv3 2.7 to 9.8, with no workarounds. CISA added vCenter CVE-2026-59310 to its KEV catalogue on 18 Aug 2026 with known ransomware use. Security Affairs [Press] reports CISA added the ESX logging flaw CVE-2026-41709 on 28 Oct with a federal deadline of 11 Nov, which is tomorrow; it has its own fixed builds in the matrix. The Broadcom advisory itself makes no statement on exploitation. First published 29 Jul 2026; revision .2 on 19 Aug added 7.0 patch guidance for the critical issues.
CVE-2026-59309 9.8vCenter VMDir auth bypass
CVE-2026-59310 9.8vCenter Syslog traversal · KEV
CVE-2026-47876 9.3ESX VMXNET3
CVE-2026-41703 7.6ESX OOB read
CVE-2026-41709 2.7ESX logging · reported KEV 28 Oct
DoPatch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f (VCF 5.x: async patch to 8.0 U3k per KB 88287). On ESX 9.0, ESXi-9.0.2.0100-25595025 covers all three ESX CVEs. On 9.1 the matrix lists ESXi-9.1.0.0200-25557999 for CVE-2026-47876 and ESXi-9.1.0.0-25370933 for the other two. On 8.0, ESXi80U3k-25595708 fixes CVE-2026-47876, U3i-25205845 CVE-2026-41703 and U3j-25429389 CVE-2026-41709; ESXi80U2f-25626445 covers only CVE-2026-47876. For VCF 5.x the matrix lists 5.2.4 for CVE-2026-41709.
If you run Avi Load Balancer (including for VKS or VCF Automation), this one matters. Seven CVEs, CVSSv3 7.1 to 9.8, no workarounds; the worst, CVE-2026-47865, is an authentication bypass on the Avi control plane. The advisory makes no statement on exploitation. First published 14 Jul 2026; revision .1 on 7 Aug added the 22.1.7-2p12 patch.
CVE-2026-47865 9.8control-plane auth bypass
CVE-2026-47871 8.8directory traversal
CVE-2026-47867 8.7RCE
CVE-2026-47869 8.7authenticated RCE
CVE-2026-47866 8.3authorisation bypass
CVE-2026-47868 7.8local privilege escalation
CVE-2026-47870 7.1privilege escalation
DoUpgrade 32.1.1 to 32.1.2 or later (the advisory's recommended version), 31.1.1–31.2.2 to 31.2.2-2p3, and 30.1.1–30.2.6 to 30.2.7. On 22.1.x, 22.1.7-2p12 fixes CVE-2026-47865, but the matrix lists 30.2.7 for the other six.
No new VMware KBs today, and the articles we follow haven't moved. KB 460791 still names SDDC Manager in VCF 9.1.1 as the only critically affected product for the Brotli flaw, with no fixed version; KB 460199 on the eMudhra certificate compromise still promises fixes "in upcoming product releases"; KB 458671 (NSX Manager 9.1.1 hanging on restart with host-based agent VM services) still has only the proton timeout workaround; KB 452660 (NSX SCRX after a 9.0.1 to 9.1.1 upgrade) still points to an unnamed upcoming NSX version; KB 456305 (VCF Operations certificate alerts) still has a fix planned; and KB 457944 still says vCenter 9.1.1.0100 avoids the Supervisor control plane VMs disappearing during an upgrade.
Releases & Release Notes Nothing new
No new VCF patches since 26 October. The 9.1.1.x patch index still tops out at SDDC Manager 9.1.1.0200, vCenter, ESX and NSX 9.1.1.0100, VCF Operations 9.1.1.0100, VCF Automation 9.1.1.0200 and vSAN File Services 9.1.1.0200, and the VCF 9.1 release notes list no 9.1.2 or 9.2 line. The async releases page has nothing new, Avi Load Balancer 32.1.4 is still the newest 32.1 release, and VCF 5.2.4 is still the newest on the 5.2 line.
Automation & IaC
Terraform & Packer One new release
The vsphere provider has its biggest release in a while; everything else is unchanged, and vcf 0.19.0 is still the one to use for VCF 9.1.1, per the README.
terraform-provider-vsphere v2.18.0terraform-provider-vsphere9 NovOfficialMost of this release is for anyone running vSphere Supervisor. vsphere_namespace can now set storage_policy blocks with an optional limit in MiB, user and group permissions, and zone blocks with per-zone limits and VM class reservations; it can also create namespaces backed by an NSX VPC or by vSphere networking, and import existing ones. There's a new Supervisor data source (d/supervisor) and a vsphere_content_library_items data source, sets now stop perpetual diffs on namespaces, and vsphere_network lookups finally honour retry_timeout (#2803). The breaking change: storage_policies is replaced by storage_policy blocks on the namespace resource and data source (#2789).
Pulumi has already picked up 2.18.0pulumi-vsphere10 NovCommunityIf you use Pulumi rather than Terraform, the vsphere bridge was bumped to 2.18.0 automatically this morning, so the same storage_policy change will reach you with the next Pulumi provider release.
Automation & API Ecosystem Nothing new
A quiet day for the wider toolchain: VCF.PowerCLI 9.1.1, govmomi 0.56.2, vmware.vmware 2.13.0, vmware.vmware_rest 5.1.0 and vcf-sdk-go 0.8.1 are all still current. Note that the vsphere provider 2.18.0 builds against a govmomi 0.57.0 pre-release, so a new govmomi tag may not be far off.
Nested Lab Corner One tool worth a look
vmware/vcf-readiness: the VCF Readiness Assessment ToolVMware on GitHub9 NovOfficialHandy before you turn retired servers into a VCF 9.1 lab. It's a dependency-free Python tool (or prebuilt binaries for Windows, macOS and Linux) that talks to iDRAC, iLO, XCC, Supermicro and Cisco IMC over Redfish and writes an HTML report per host, covering CPU support against KB 428874, vSAN ESA and OSA readiness, TPM 2.0, Intel VMD settings, NVMe health and switch neighbours.
Deep Dive of the Day
Building vSphere Namespaces as code with the vsphere provider 2.18.0
A vSphere Namespace is where a Supervisor's tenants actually live: it carries the permissions, storage policies, resource limits, VM Service settings and zone that VKS clusters and VM Service VMs inherit. Broadcom's namespace guide walks through it as a series of panes in the vSphere Client. Each storage policy you assign becomes a storage class that's replicated into VKS clusters, and setting limits creates a resource pool in vCenter. That's a lot of state to keep consistent by hand across sites, which is why yesterday's provider release matters.
Version 2.18.0 turns vsphere_namespace into something you can genuinely manage end to end. You can now declare storage_policy blocks, each with an optional limit in MiB; user and group blocks for access; and zone blocks with per-zone limits and VM class reservations. A namespace can be backed by an NSX VPC or, through the new vsphere_network attribute, by one or more distributed port groups; PR #2794 makes that mutually exclusive with vpc_network. Existing namespaces can be imported, and the new Supervisor data source (d/supervisor in the release notes) looks up a Supervisor by ID, name or cluster, so you no longer need to hard-code its identifier.
The one thing to plan for is the breaking change. storage_policies is gone, replaced by storage_policy blocks on both the resource and the data source. PR #2789 says the old and new forms are incompatible on purpose, so Terraform fails at plan or apply rather than quietly changing a namespace, and the resource documentation carries the upgrade steps. Keep ~> 2.17 pinned until you've rewritten those blocks, and use the move as a chance to add the per-policy limits you couldn't express before. The release also switches attributes with unstable ordering to sets, which should end the perpetual diffs some of you have seen on namespaces.
Code makes namespace settings repeatable, not reversible, and the TechDocs caveats still apply. On a multi-zone Supervisor only topology-aware storage policies can be assigned. If you override NSX network settings for a namespace, the Tier-0 gateway, NAT mode and subnet prefix can't be changed afterwards, and the namespace's subnets, ingress and egress ranges mustn't overlap the Supervisor's or any other namespace's. The resource limits page adds that CPU and memory limits behave differently for VKS nodes depending on whether their VM class is best effort or guaranteed, so check your classes before you put hard caps in code.
For a working pattern, Will Arroyo's vcf-terraform-examples creates a namespace with the vsphere provider and then deploys into it with the Kubernetes provider, authenticating with a token from the Supervisor's /wcp/login endpoint so no kubeconfig is needed and one apply does both. It was written before 2.18.0, so expect to adjust the storage attributes, and note his own warning that the vCenter password ends up in Terraform state. In a nested lab, a single zone, one storage policy with a modest limit and imported namespaces are an easy way to try all of this before you touch production.
Broadcom Contributes VM API Open Source Project to Cloud Native Computing FoundationBroadcom (GlobeNewswire)9 NovOfficialBroadcom's main KubeCon announcement. VM API, a way to provision and manage virtual machines through Kubernetes APIs across providers, has been accepted into the CNCF Sandbox; Broadcom is also co-chairing a new Kubernetes Workload Conformance Working Group and has validated more than 20 new partner solutions for VKS, including Datadog, CrowdStrike Falcon, Dell PowerProtect Data Manager and Traefik. The release gives no dates and commits to nothing.
Broadcom Contributes API for Virtual Machines to CNCFCloud Native Now9 NovPressMike Vizard's write-up, quoting VCF CMO Prashanth Shenoy on making VMs "first-class citizens" in cloud-native environments. It puts the VKS partner count at 30, where Broadcom's own release says more than 20.
Features & Technical Blogs Two from KubeCon
Advancing the Cloud-Native Ecosystem Through Open CollaborationVCF Blog9 NovOfficialThe engineering view of Broadcom's KubeCon week from Dilpreet Bindra. Beyond VM API, which builds on Broadcom's VM Operator, it covers Velero 1.19's block-level data movement and its move into the CNCF Sandbox, work on COSI and an open-source vSphere COSI driver, and Agent Substrate for sandboxed agentic AI workloads.
Quick Tip - How to Manually Verify VCF Software Download Checksums?William Lam9 NovCommunityUseful if you move VCF binaries into an air-gapped depot by hand. The SHA256 for every binary is in productVersionCatalog.json (under /PROD/metadata/productVersionCatalog/v1/ when you use the VCF Download Tool), and William shows how to check a file with sha256sum or Get-FileHash, then verify the catalogue's own signature with openssl. The Download Tool already does this for you, so it matters most for files fetched another way.
Virtually Speaking: Modernizing VM Management: Introducing KubeVM ServiceVirtually Speaking Podcast6 NovOfficialStill the newest episode, and a good companion to the VM API news. Pete Flecha and Jad El-Zein talk to Shruthi Rajashekar and Arunesh Pandey about Kubernetes-native VM management in VCF, the proposed vendor-neutral VM API and how it compares with KubeVirt.
Broadcom at KubeCon + CloudNativeCon North America 2026VCF Blog9–12 NovOfficialRunning in Salt Lake City until Thursday, with Broadcom at booth #129 and booth talks on VKS 3.8 chained upgrades, vSphere Pods with Agent Sandbox, Velero 1.19 and the VM API.
VMware Explore on Tour LondonVMware Explore18–19 NovOfficialEight days away, with a VMUG community happy hour on the evening of 19 November. Washington, D.C. follows on 8 December and Sydney on 3–4 March 2027.
Certification & Learning Nothing new
No exam changes today. The VMware vSphere Foundation 9.0 Administrator exam guide (2V0-16.25) carries a November 2026 date, and the three role-based VCF 9 VCAP exams, Administrator (3V0-11.26), Architect (3V0-12.26) and Support (3V0-13.26), launched in September, per Eric Sloof [Community].
