Security Advisories New VMSA
There's one new advisory today, VMSA-2026-0008, for the Node.js Brotli flaw in VCF, and it has no fix yet. The other three are the most recently released or updated advisories; Broadcom's advisory portal has the rest. vCenter CVE-2026-59310 (VMSA-2026-0006) is still the exploited one to have patched. Broadcom's KB 460199 on the eMudhra certificate compromise still has no fix. On PHP2Shell, which CISA added to its KEV catalogue on 26 Oct per The Register, Broadcom's KB 459989 still says no VCF products are affected, alongside the vDefend (KB 460110) and Avi (KB 460068) statements.
New today. Broadcom's advisory list gives the title as "Node.js Brotli decoder out-of-bounds write remote code execution vulnerability (CVE-2026-111497)", rated critical for VMware Cloud Foundation and open. SecurityOnline [Press] reports that the affected component is SDDC Manager, scored 9.8 on 9.1.1 and 7.5 (important) on 9.0.x, 9.1.0 and 5.2.x, with every fixed version still "Patch pending". The Hacker News [Press] reports that CISA added the Brotli flaw to its KEV catalogue on 27 Oct; Broadcom's listing makes no statement on exploitation of VMware products.
DoRead the advisory, apply its workarounds (reported as KB 460732 for 9.1.1 and KB 460734 for older releases), restrict SDDC Manager to trusted admin networks, and subscribe for the patch.
For desktop hypervisors: Workstation and Fusion 25H2 and 26H1, CVSSv3 8.1 to 9.3. Both CVEs need local admin rights inside a guest and can lead to code execution on the host; the advisory makes no statement on exploitation. First published 3 Sep 2026.
- CVE-2026-59346 9.3 VMXNET3 integer overflow
- CVE-2026-59347 8.1 HGFS stack overflow
DoUpdate Workstation and Fusion to 26H1u1. There's no workaround, so if you run nested labs on a laptop, do it soon.
This is the one to prioritise. It covers vCenter, ESX, Workstation and Fusion (and so VCF, VVF and Telco Cloud), with CVSSv3 scores from 2.7 to 9.8 and no workarounds. CISA added CVE-2026-59310, a vCenter Syslog directory traversal, to its KEV catalogue on 18 Aug 2026 with known ransomware use; the Broadcom advisory itself makes no statement on exploitation. First published 29 Jul 2026.
- CVE-2026-59309 9.8 vCenter VMDir auth bypass
- CVE-2026-59310 9.8 vCenter Syslog traversal · KEV
- CVE-2026-47876 9.3 ESX VMXNET3
- CVE-2026-41703 7.6 ESX OOB read
- CVE-2026-41709 2.7 ESX logging
DoPatch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f (VCF 5.x: async patch per KB 88287; 7.0 extended-support customers should contact Broadcom). For ESX, apply ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708 or ESXi80U2f-25626445. A vCenter that has been reachable and unpatched is safest treated as possibly compromised.
If you run Avi Load Balancer (including for VKS or VCF Automation), this one matters. Seven CVEs, CVSSv3 7.1 to 9.8, no workarounds. The worst, CVE-2026-47865, is an authentication bypass on the Avi control plane, and two others allow remote code execution (the advisory also describes code execution for CVE-2026-47870). The advisory makes no statement on exploitation. First published 14 Jul 2026; revision .1 on 7 Aug added a 22.1.7-2p12 patch.
- CVE-2026-47865 9.8 control-plane auth bypass
- CVE-2026-47871 8.8 directory traversal
- CVE-2026-47867 8.7 RCE
- CVE-2026-47869 8.7 authenticated code injection
- CVE-2026-47866 8.3 authorisation bypass
- CVE-2026-47868 7.8 local privilege escalation
- CVE-2026-47870 7.1 privilege escalation
DoUpgrade 32.1.x to 32.1.2 or later (the advisory's recommended fix), 31.1.1–31.2.2 to 31.2.2-2p3, and 30.1.1–30.2.6 to 30.2.7. On 22.1.x, 22.1.7-2p12 fixes CVE-2026-47865, but the matrix lists 30.2.7 for the other six CVEs, so plan the move to 30.2.7.
All VMware security advisories on Broadcom's support portal →
KB Articles & Known Issues Trackers unchanged
No new VMware KBs today beyond the workaround articles tied to VMSA-2026-0008, which SecurityOnline cites as KB 460732 and KB 460734. The ones we follow haven't moved: KB 457944 still says the Supervisor control plane VMs fix is "in the next release of VCF 9.1.1" (the Supervisor 9.1.1.0100 release notes list it as resolved); KB 458671 (NSX Manager hanging on startup with host-based agent VM services) and KB 452660 (SCRX after an NSX 9.0.1 to 9.1.1 upgrade) still name no fix version; KB 456305 (certificate alerts after upgrading to VCF 9.1.1) still has a fix planned; and KB 460199 (eMudhra certificates) still promises fixes in upcoming releases.
Releases & Release Notes Nothing new
No new patches today, and nothing yet for VMSA-2026-0008. The 9.1.1.x patch index still shows the 12 October batch as the newest, plus vSAN File Services 9.1.1.0200 from 26 October; the Async Releases page has nothing after 12 October and the release notes index shows no 9.1.2 or 9.2 line. The current SDDC Manager 9.1.1.0200 notes (build 25801071) don't mention the Brotli flaw, so that's the patch to watch for. VKS is still on 3.8.0 and Avi on 32.1.4.
Automation & IaC
Terraform & Packer One change to watch
No new provider or Packer plugin releases, so vcf 0.19.0 is still the one for VCF 9.1.1 (per the README and the v0.19.0 release). The interesting activity is in pull requests heading for the next releases.
- vsphere PR #2789: storage limits on namespace storage policies github.com/vmware Merged 27 Oct Official Worth knowing before 2.18.0 ships if you build Supervisor namespaces in code.
vsphere_namespace gets a reworked storage_policies attribute that both assigns a policy and sets an optional storage limit, and the PR is labelled as a breaking change. A follow-up (PR #2790) adds an upgrade note, and PR #2791 adds role-based access control for namespaces. - nsxt PR #2385: fix VPC lookup path boundaries github.com/vmware Merged 27 Oct Official A quiet but useful fix: VPC lookups no longer match a sibling VPC whose ID shares a prefix. It follows PR #2373, merged on 23 Oct, which adds 16 VPC load balancer resources and five data sources for NSX 9.0 and later, and PR #2387, still open, stops unmanaged VPC virtual server rules from being planned for deletion.
Deep Dive of the Day What SDDC Manager still does in VCF 9.1, and why it deserves a tight network boundary
With SDDC Manager in the spotlight today, it's worth being clear about what it still does. In VCF 9.1 the SDDC Manager UI is deprecated: the docs say its workflows "can now be found in VCF Operations and vSphere Client", covering licensing, certificates, host and domain management, lifecycle, passwords and backup. It's easy to read that as "SDDC Manager is going away". It isn't: only the UI is.
The components overview describes SDDC Manager as "a part of VCF Operations" that provides the engine behind lifecycle management for ESX, vCenter, HCX and NSX, deploying workload domains, importing existing vCenter instances and configuring vSAN stretched clusters. It lives in each VCF instance's management domain. The lifecycle management overview puts it alongside vCenter, NSX Manager and ESX as an instance-level core component, with VCF Operations orchestrating everything through its fleet lifecycle, SDDC lifecycle and depot components.
That's why an SDDC Manager vulnerability matters more than the deprecated UI might suggest. It sits behind lifecycle for the whole instance, working directly with the vCenter, NSX Manager and ESX hosts it manages. In practice, the people and systems that need to reach it are your admin jump hosts and VCF Operations; nothing else in the estate should.
If you restrict access as a workaround, remember VCF Operations drives SDDC Manager's workflows, so a firewall rule that blocks VCF Operations or the fleet lifecycle components will quietly break upgrades, password rotation and certificate tasks. Test a harmless operation, such as a precheck, after any change. On upgrades, WWT's step-by-step walkthrough [Community] is a good reminder of the order: SDDC Manager upgrades straight after VCF Operations reaches 9.1, it's triggered from the VCF Operations UI rather than SDDC Manager for 9.0.x sources, and depot authentication then has to move from a download token to an activation code.
In a nested lab, SDDC Manager is often the appliance people are tempted to put on a flat, wide-open network. It's worth giving it the same treatment you would in production: keep it on the management network, reach it through a jump host, and keep a current file-based backup so you can roll back if a patch or a workaround misbehaves. When the VMSA-2026-0008 patch arrives, apply it through VCF Operations like any other SDDC Manager patch.
Based on SDDC Manager Workflows in VMware Cloud Foundation 9.1 Official Components in VCF and vSphere Foundation Official Lifecycle Management in VMware Cloud Foundation Official The VCF 9.1 Upgrade, Step by Step: What Actually Happens (WWT)
Industry Brotli and PHP
Licensing, Business & Industry News Brotli and PHP
- Adobe Commerce PolyShell attacks breach hundreds of stores as Brotli exploit traffic emerges The Hacker News 28 Oct Press The context for today's advisory. CISA has added the Brotli flaw to its KEV catalogue, and honeypot operators have started to record exploit attempts, though the evidence so far is limited. Node.js fixed it in 22.23.4, 24.22.1 and 26.12.1.
- Brotli bug reaches far beyond Node.js (CVE-2026-111497) Help Net Security 27 Oct Press A good explainer if you look after anything that decompresses untrusted data: .NET, Bun, Envoy, Istio, Python HTTP clients, FFmpeg and more are in scope, and the fix sat unreleased in the Brotli source for about eight months. Fixed Brotli versions are 1.0.10, 1.1.1 and 1.2.1.
- Microsoft releases emergency .NET security fixes for Google Brotli bug The Register 26 Oct Press Microsoft patched .NET 8 to 11 out of band and rates the flaw 8.1. Relevant if you run .NET tooling or workloads on your VCF estate, and a reminder to rebuild and restart containers so fixes actually take effect.
- CISA confirms PHP2Shell under attack as researchers clock successful exploits The Register 27 Oct Press CISA added the PHP flaws CVE-2026-109618 and CVE-2026-109619 to KEV on 26 Oct, with a 29 Oct deadline for US federal agencies. Broadcom's KB 459989 still says no VCF products are affected, but PHP workloads you host need 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Sources (24)
