Security Advisories Latest four
No new VMSA today, so these are the four most recently released or updated advisories; Broadcom's advisory portal has the rest. The new piece is Broadcom's portfolio statement on the Brotli flaw, KB 460791, which says only SDDC Manager in VCF 9.1.1 is critically affected and points to VMSA-2026-0008 for remediation. vCenter CVE-2026-59310 (VMSA-2026-0006) remains the most important patch if you haven't applied it. The Linux kernel TCP flaw CVE-2026-98432 still has no Broadcom impact statement.
Node.js, as used in SDDC Manager, has a Brotli decoder out-of-bounds write that an attacker with network access to SDDC Manager could use to run code. It is critical (9.8) on SDDC Manager 9.1.1 and important (7.5) on 9.0.x, 9.1.0 and 5.2.x; revision .1 on 28 Oct clarified that only SDDC Manager is affected. Every fixed version is still "Patch pending". New today: Broadcom's portfolio statement KB 460791 says none of its products is critically affected except SDDC Manager in VCF 9.1.1. Sophos [Press] and earlier press reports say CISA added the underlying Brotli flaw to its KEV catalogue on 27 Oct; the Broadcom advisory itself makes no statement on exploitation. Issue date 27 Oct 2026.
- CVE-2026-111497 9.8 SDDC Manager Node.js Brotli · 9.8 on 9.1.1, 7.5 elsewhere · reported KEV 27 Oct
DoApply KB 460732 on 9.1.1 or KB 460734 on 9.0.x, 9.1.0 and 5.2.x, restrict SDDC Manager to trusted admin hosts, and subscribe to the advisory for the patch.
For desktop hypervisors: Workstation 25H2 and 26H1 and Fusion 25H2 and 26H1, CVSSv3 8.1 to 9.3. Both CVEs need local admin rights inside a guest and can lead to code execution on the host. There are no workarounds and the advisory makes no statement on exploitation.
- CVE-2026-59346 9.3 VMXNET3 integer overflow
- CVE-2026-59347 8.1 HGFS stack overflow
DoUpdate Workstation and Fusion to 26H1u1, especially if you run nested labs on a laptop.
Still the one to prioritise. It covers vCenter, ESX, Workstation and Fusion (and so VCF, VVF and Telco Cloud), CVSSv3 2.7 to 9.8, with no workarounds. CISA added vCenter CVE-2026-59310 to its KEV catalogue on 18 Aug 2026 with known ransomware use. Security Affairs [Press] reports CISA added the ESX logging flaw CVE-2026-41709 on 28 Oct with a federal deadline of 11 Nov; it has its own fixed builds in the matrix. The Broadcom advisory itself makes no statement on exploitation. First published 29 Jul 2026.
- CVE-2026-59309 9.8 vCenter VMDir auth bypass
- CVE-2026-59310 9.8 vCenter Syslog traversal · KEV
- CVE-2026-47876 9.3 ESX VMXNET3
- CVE-2026-41703 7.6 ESX OOB read
- CVE-2026-41709 2.7 ESX logging · reported KEV 28 Oct
DoPatch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f (VCF 5.x: async patch to 8.0 U3k per KB 88287). On ESX 9.0, ESXi-9.0.2.0100-25595025 covers all three ESX CVEs. On 9.1 the matrix lists ESXi-9.1.0.0200-25557999 for CVE-2026-47876 and ESXi-9.1.0.0-25370933 for the other two. On 8.0, ESXi80U3k-25595708 fixes CVE-2026-47876, U3i-25205845 CVE-2026-41703 and U3j-25429389 CVE-2026-41709; ESXi80U2f-25626445 covers only CVE-2026-47876. For VCF 5.x the matrix lists 5.2.4 for CVE-2026-41709.
If you run Avi Load Balancer (including for VKS or VCF Automation), this one matters. Seven CVEs, CVSSv3 7.1 to 9.8, no workarounds; the worst, CVE-2026-47865, is an authentication bypass on the Avi control plane. The advisory makes no statement on exploitation. First published 14 Jul 2026; revision .1 on 7 Aug added the 22.1.7-2p12 patch.
- CVE-2026-47865 9.8 control-plane auth bypass
- CVE-2026-47871 8.8 directory traversal
- CVE-2026-47867 8.7 RCE
- CVE-2026-47869 8.7 authenticated RCE
- CVE-2026-47866 8.3 authorisation bypass
- CVE-2026-47868 7.8 local privilege escalation
- CVE-2026-47870 7.1 privilege escalation
DoUpgrade 32.1.1 to 32.1.2 or later (the advisory's recommended version), 31.1.1–31.2.2 to 31.2.2-2p3, and 30.1.1–30.2.6 to 30.2.7. On 22.1.x, 22.1.7-2p12 fixes CVE-2026-47865, but the matrix lists 30.2.7 for the other six.
All VMware security advisories on Broadcom's support portal →
KB Articles & Known Issues One KB worth reading
The KBs we follow haven't moved. KB 460732 still names no fixed SDDC Manager version; KB 458671 (NSX Manager startup) and KB 452660 (SCRX after the 9.0.1 to 9.1.1 upgrade) still name no fix version; KB 456305 still has a fix planned for an upcoming release; KB 457944 still points to the next 9.1.1 release, though Supervisor 9.1.1.0100 already lists it as resolved; and KB 460199 still promises eMudhra fixes in upcoming releases.
- KB 460791: Node.js Brotli decoder vulnerability, CVE-2026-111497, and VMware by Broadcom product portfolio Broadcom KB Newly published Official Broadcom's portfolio-wide answer to the Brotli flaw. It lists VCF and VVF components and add-ons on 5.2.x and 9.x, Cloud Director, Remote Console, HCX, PowerCLI, Telco Cloud Platform, Workstation and Fusion, and says none is critically affected except SDDC Manager in VCF 9.1.1, with remediation tracked in VMSA-2026-0008. Useful to hand to your security team when they ask which VMware boxes need attention.
Releases & Release Notes Nothing new
A quiet weekend on TechDocs, and still no SDDC Manager patch for VMSA-2026-0008. The 9.1.1.x patch index still shows the 12 October batch plus vSAN File Services 9.1.1.0200 (26 October), the Async Releases page has nothing newer, and the release notes index shows no 9.1.2 or 9.2 line. VKS is still on 3.8.
Automation & IaC
Terraform & Packer Nothing new
Nothing new from the providers or Packer plugins today, so vcf 0.19.0 is still the one to use for VCF 9.1.1, per the README. The open items from earlier in the week still stand: the unreleased vsphere 2.18.0 changes vsphere_namespace storage policies, packer-plugin-vsphere has a 2.5.1 milestone in progress, and avi issue #719 (removing a pool's last server is silently ignored) has no fix yet.
Automation & API Ecosystem All quiet
PowerCLI 9.1.1, govmomi 0.56.2, pyVmomi 9.1.1.0 and the Ansible collections are unchanged. William Lam's VCF 9.1 Upgrade Planner write-up from 22 October is still the best primer if you're planning a 9.1.1 upgrade.
Deep Dive of the Day Memory tiering over NVMe in VCF 9.1: where it helps and where it bites
Memory tiering lets an ESX host use local NVMe as a second tier of memory behind DRAM. The host scans VM memory, classifies pages as hot or cold by how recently and how often they're touched, and moves the cold ones down to NVMe while the hot ones stay in DRAM. Only VM memory is tiered; kernel memory never is. Per the considerations and best practices page, tiering only starts once host memory consumption reaches about 80% of DRAM, and KB 449016 adds that the migration rate is deliberately conservative just past that mark and ramps up with pressure, so a host sitting at 70–75% showing nothing on NVMe is behaving as designed.
Sizing is all about active memory, not consumed memory. Broadcom's guidance is to target hosts whose active memory is between 0% and 50% of DRAM, and its worked example is a 1 TB host with 200 GB active that can double its VM count to 1.6 TB consumed while active memory stays at 400 GB. The default and recommended ratio is 1:1 (tier_size_pct of 100, adjustable from 1 to 400), and you shouldn't combine tiering with memory overcommit. Luciano Patrao's write-up makes the practical point well: check active memory at peak and in N+1 and maintenance states, not just on an average day.
Hardware matters. Use dedicated local Mixed-Use enterprise NVMe of at least 3 DWPD, at least as large as host DRAM, and never share a drive with vSAN, which can mean a separate pair of drives on a ReadyNode. In 9.1 you can mirror the tier in software across two NVMe devices with esxcli memtier enable -d "device-1, device-2", so a single drive failure doesn't take down every VM with pages on it; hardware RAID behind a supported controller is also supported. NVMe encryption for the tier is off by default and can be turned on host-wide or per VM.
Configuration is cleanest at cluster level through vSphere Configuration Profiles, under the esx > memtier > nvme settings, which puts hosts into maintenance mode for you. If you use ESXCLI or PowerCLI instead, you have to enter maintenance mode yourself. On the day-two side, vMotion of a tiered VM takes roughly 1.5 to 2 times longer because pages have to come back from NVMe first, which slows host evacuations and lifecycle remediation, though DRS understands mixed clusters of tiered and non-tiered hosts. For monitoring, KB 449016 points to memstats -r vmtier-stats on the host and the memory read and write bandwidth and latency counters in the vSphere Client.
For production, Patrao's write-up lists the workloads he keeps out of tiering: fully reserved VMs, DirectPath I/O passthrough, Latency Sensitivity High and 1 GB pages stay in DRAM, and he recommends excluding very large VMs and in-memory databases such as SAP HANA. For nested labs, the same post notes that nested ESX VMs are excluded by default and need sched.mem.enableNestedTiering = TRUE set before power-on. Treat both lists as a community summary and check them against the configuration docs for your build before you rely on them.
Based on Memory Tiering Considerations and Best Practices (vSphere 9.1) Official Memory Tiering Configuration (vSphere 9.1) Official KB 449016: Understanding NVMe Memory Tiering activation thresholds and monitoring in vSphere 9.x Official VCF 9.1 Memory Tiering: Before You Cut the DRAM (Luciano Patrao)
Industry
Features & Technical Blogs Three worth reading
- Good Fences, Good Neighbors: Isolating Infrastructure Management VMware Cloud Foundation blog 30 Oct Official Bob Plankers' practical guide to the management network, and well timed given the SDDC Manager advice this week. Put ESX management on its own VLAN per workload domain, firewall between segments rather than trusting VLANs, restrict ESX firewall services to management networks, add your admin networks to the vCenter appliance firewall before turning restrictions on, enable VCF Operations firewall hardening (off by default), keep BMCs on an isolated VLAN, and allow outbound traffic only to Broadcom URLs through a proxy.
- Why VMware Memory Tiering is Not Just Swapping to NVMe VMware Cloud Foundation blog 30 Oct Official Dave Morera explains why tiering is proactive rather than a last-resort swap: VM pages are classified hot or cold by recency and frequency, cold pages move to NVMe, and the hypervisor itself always stays in DRAM. The default is a 1:1 DRAM-to-NVMe ratio with a 4 TB tiering cap, and it suits workloads whose active memory fits in DRAM.
- Workloads Keeping Secrets: Confidential Computing VMware Cloud Foundation blog 30 Oct Official A short primer on confidential VMs with AMD SEV-SNP (EPYC Milan onwards) and Intel TDX (5th Gen Xeon onwards). You need the CPU features enabled consistently in firmware across the cluster and virtual hardware 22 or later, all VM memory is reserved, and TDX attestation needs a network path to Intel's services, which matters in isolated sites.
Licensing, Business & Industry News Security in the news
- 'Node2Shell' vulnerability (CVE-2026-111497) in active exploitation Sophos Late Oct Press Sophos's round-up of the Brotli flaw behind VMSA-2026-0008: it reports active exploitation, notes CISA's KEV addition on 27 October, and says Microsoft and PHP have also shipped fixes. It doesn't mention VMware, but it's a useful reminder that Brotli sits in far more than SDDC Manager.
- U.S. CISA adds Linux kernel and Broadcom VMware ESX flaws to its KEV catalogue Security Affairs 29 Oct Press Reports CISA's 28 October addition of ESX logging flaw CVE-2026-41709 and the Linux Fragnesia flaw CVE-2026-46300, with federal deadlines of 11 November and 31 October respectively. Broadcom's KB 439687 says ESXi and Photon-based appliances aren't affected by Fragnesia.
Sources (34)
