VMSA-2026-0008.1 — Apply KB 460732 on 9.1.1 or KB 460734 on 9.0.x, 9.1.0 and 5.2.x, restrict SDDC Manager to trusted admin hosts, and subscribe to the advisory for the patch.
Details →The story worth your attention today is a new Broadcom KB on the eMudhra certificate compromise. The private keys of eight eMudhra intermediate certificate authorities turned out to be guessable, and KB 460199 lists VCF and VVF 9.1.1 and 5.2.4 components, along with Cloud Director, HCX, Remote Console, PowerCLI, Telco Cloud Platform, Workstation and Fusion, as affected. Broadcom rates it high severity and says fixes will come in upcoming releases and documentation, so there's nothing to install yet.
There's no new VMSA today, and vCenter CVE-2026-59310 is still the one to patch first.
Elsewhere, the VCF blog explains the new Salt API for configuration and drift management of VCF components in 9.1.1, govmomi has a small 0.56.2 bugfix release, and Unexplored Territory is back with a vSAN roadmap episode. Builds, providers and the KBs we're tracking are unchanged. With certificates on everyone's mind, the deep dive walks through how certificate management works in VCF 9.1.
This is an earlier briefing. Read today's Latest Tech News →
No new VMSA today, so these are the four most recently released or updated advisories; Broadcom's advisory portal has the rest. vCenter CVE-2026-59310 (VMSA-2026-0006) is still the one to patch first. Broadcom's new KB 460199 covers the eMudhra intermediate CA compromise (CVE-2026-111943): it lists VCF and VVF 9.1.1 and 5.2.4 among the affected products, rates it high severity and has no fix yet (see the KB section below). On PHP2Shell, the statements for VCF (KB 459989), vDefend (KB 460110) and Avi (KB 460068) are unchanged: not affected. None of them yet covers the newer PHP flaw CVE-2026-115560, and Broadcom still hasn't published a statement on the Brotli decoder flaw CVE-2026-111497.
For desktop hypervisors: Workstation and Fusion 25H2 and 26H1, CVSSv3 8.1 to 9.3. Both CVEs need local admin rights inside a guest and can lead to code execution on the host; the advisory makes no statement on exploitation. First published 3 Sep 2026.
DoUpdate Workstation and Fusion to 26H1u1. There's no workaround, so if you run nested labs on a laptop, do it soon.
This is the one to prioritise. It covers vCenter, ESX, Workstation and Fusion (and so VCF, VVF and Telco Cloud), with CVSSv3 scores from 2.7 to 9.8 and no workarounds. CISA added CVE-2026-59310, a vCenter Syslog directory traversal, to its KEV catalogue on 18 Aug 2026 with known ransomware use; the Broadcom advisory itself makes no statement on exploitation. First published 29 Jul 2026.
DoPatch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f (VCF 5.x: async patch per KB 88287; 7.0 extended-support customers should contact Broadcom). For ESX, apply ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708 or ESXi80U2f-25626445. A vCenter that has been reachable and unpatched is safest treated as possibly compromised.
If you run Avi Load Balancer (including for VKS or VCF Automation), this one matters. Seven CVEs, CVSSv3 7.1 to 9.8, no workarounds. The worst, CVE-2026-47865, is an authentication bypass on the Avi control plane, and two others allow remote code execution (the advisory also describes code execution for CVE-2026-47870). The advisory makes no statement on exploitation. First published 14 Jul 2026; revision .1 on 7 Aug added a 22.1.7-2p12 patch.
DoUpgrade 32.1.x to 32.1.2 or later (the advisory's recommended fix), 31.1.1–31.2.2 to 31.2.2-2p3, and 30.1.1–30.2.6 to 30.2.7. On 22.1.x, 22.1.7-2p12 fixes CVE-2026-47865, but the matrix lists 30.2.7 for the other six CVEs, so plan the move to 30.2.7.
Three stored cross-site scripting flaws in VCF Operations and Aria Operations, each CVSSv3 8.0. Someone with rights to create policies, views or text widgets could plant scripts that perform administrative actions. No workarounds, and no statement on exploitation. First published 8 Jun 2026.
DoVCF Operations 9.1.x is fixed from 9.1.0.0 and 9.0.x needs 9.0.2.0 EP2. Aria Operations 8.x and Aria Operations under VCF 5.x need 8.18.7 to fix all three (Telco Cloud Platform: KB 443138).
All VMware security advisories on Broadcom's support portal →
The trackers haven't moved. KB 457944 still says the Supervisor control plane VMs fix is "in the next release of VCF 9.1.1", although the Supervisor 9.1.1.0100 release notes list it as resolved. KB 458671 (NSX Manager hanging on startup with host-based agent VM services) and KB 452660 (SCRX after an NSX 9.0.1 to 9.1.1 upgrade) still name no fix version, and KB 456305 (VCF Operations certificate alerts after 9.1.1) still says a fix is planned for an upcoming release.
No new patches since yesterday's vSAN File Services 9.1.1.0200, whose release notes are the place to start if you run File Services. Otherwise the newest batch of 9.1.1.x patches is still 12 October, the release notes index shows no 9.1.2 or 9.2 line, VKS is still on 3.8.0 and Avi on 32.1.4.
Nothing new from the providers or the Packer plugins, so vcf 0.19.0 is still the one to use for VCF 9.1.1. The vcf provider README lists VCF 9.1.1 support from v0.19.0, and the v0.19.0 release (7 Oct) is still the latest. The vsphere provider is still on 2.17.1, vcfa on 1.2.3, and the vsphere and vmware Packer plugins on 2.5.0 and 2.1.6.
Otherwise unchanged: VCF.PowerCLI 9.1.1.25718932 (10 Sep) is still the current version on the PowerShell Gallery.
Run call now returns an error when the process isn't found, plus CI housekeeping. Worth picking up if you use govc or govmomi's guest operations in your build pipelines. With the eMudhra news it's a good moment to know exactly who signs what in your fleet. In VCF 9.1, certificate management lives in VCF Operations under Fleet Management > Certificates, and every component starts life with a certificate from the VMware Certificate Authority (VMCA). The docs split certificates three ways: user-managed ones get the full lifecycle in VCF Operations (CSR, import, replace, auto-renew); externally managed ones are only watched and alerted on, so you renew them in the component's own UI, API or CLI; and system-managed ones renew themselves, usually during upgrades, and aren't shown at all.
Coverage is broad. Management components (VCF Operations, VCF Automation, Operations for networks, log management, the license server, identity broker, management services and cloud proxy) sit alongside instance components from 5.2 onwards (ESX, vCenter, NSX Manager, SDDC Manager, Supervisor), with HCX and Avi joining through their management packs. The 9.1.1 certificate blog adds vCenter STS and VMCA root certificates, NSX Edge, Supervisor and license server certificates to that list, plus alerting when a component-managed renewal fails.
The CA you choose decides what VCF can do for you. You configure a CA for the fleet as VMCA, Microsoft CA (the URL must start with https:// and end with certsrv, and from 9.1 the CA and Web Enrollment roles can sit on different machines) or OpenSSL CA, which is meant for test and can't be chained into an existing PKI. Auto-renewal only works for certificates from a configured CA on components that support non-disruptive updates. Anything signed by an external CA, or self-signed, has to go through the manual CSR, sign, import and replace cycle, and VCF Operations can't renew it for you. From 9.1.1 you can also swap any certificate back to a VMCA-signed one.
The production gotchas are mostly about names. VCF 9.1 needs the FQDN in the Subject Alternative Name, and without it inventory migration and registration fail during the upgrade; an IP is optional, and KB 457419 suggests adding one only where integrations connect by IP, noting that many public CAs reject private addresses. Hostname checks follow RFC 6125, so an IP-only SAN fails, and dot-less short names break CSR generation. Keys must be RSA 2048, 3072 or 4096. Replacing ESX certificates from VCF Operations flips vCenter's vpxd.certmgmt.mode to Custom, which is expected.
Daniel Micanek's write-up adds the practical side: renewal from Fleet Management opens 60 days before expiry, expired certificates can't be replaced, so imported ones need a calendar reminder; root and intermediate certificates are never auto-renewed; and new ESX hosts should get CA-signed certificates before commissioning, or they can fail with "Host SSL certificate is not trusted by SDDC Manager". In a nested lab the OpenSSL CA is the easy route to a working chain, and keeping every host on the same CA saves a lot of commissioning pain later.
No new exam or course announcements this week. If you're working towards a VCF 9 certification, the VMware Cloud Foundation Administrator exam guide (2V0-17.25, based on VCF 9.0, last updated 23 Apr 2026) is still the current reference.
Tags: Official Broadcom and VMware sources, Press trade press, Community community posts and unverified reports.
Questions, ideas, or just want to talk VCF? Drop me an email or find me on the socials.