Critical

VMSA-2026-0008.1 — Apply KB 460732 on 9.1.1 or KB 460734 on 9.0.x, 9.1.0 and 5.2.x, restrict SDDC Manager to trusted admin hosts, and subscribe to the advisory for the patch.

Details →

Latest News from the Web

Weekend edition · archive

It's a calm start to November. The one change you might feel today is on the provider side: from 1 November, new VMware Cloud Services Provider contracts are booked as VCSP Commit and managed in the Support Portal's Licensing module rather than the Consumption Portal, per KB 456620. Existing contracts stay where they are.

There's no new VMSA today. SDDC Manager's Brotli flaw is still waiting on a patch, so the interim workaround remains your protection, and vCenter CVE-2026-59310 is still the patch to make sure you have.

Otherwise TechDocs, the Terraform providers and the KBs we follow are unchanged. Azure VMware Solution's licence-included PayGo SKUs retired yesterday, and the deep dive looks at vSphere Lifecycle Manager images in VCF 9, including the composite images that let one cluster carry mixed hardware.

This is an earlier briefing. Read today's Latest Tech News →

  • Security No new VMSA SDDC Manager workaround is still the first job
  • Releases & KBs All quiet No new patches or KBs since Friday
  • Terraform & Packer Nothing new vcf 0.19.0 is still the one for VCF 9.1.1
  • Next deadline 5 Nov VMUG November Global Virtual Event

Key Takeaways

  • Urgent Keep the Brotli workaround on SDDC Manager and keep it fenced off. VMSA-2026-0008.1 still says "Patch pending" for every SDDC Manager release, critical (9.8) on 9.1.1 and important (7.5) on 9.0.x, 9.1.0 and 5.2.x. Use KB 460732 on 9.1.1 and KB 460734 on the others, and if you upgrade before the fix ships, run the KB 460732 script's check again, because an upgrade to a release with the unfixed runtime removes the workaround.
  • Urgent Make sure every ESX host has the fix for the logging flaw CVE-2026-41709. The VMSA-2026-0006 response matrix lists ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 for 8.0 and VCF 5.2.4 for VCF 5.x. Security Affairs reports a CISA federal deadline of 11 November.
  • This month If you're a cloud provider, new VCSP contracts now live in the Licensing module. From today, new VCSP bookings are VCSP Commit contracts, managed under My Entitlements in the Support Portal. Managing them needs the Product Administrator role, so it's worth requesting that before your next booking, per KB 456620.
  • Before upgrading Pin the vsphere provider to ~> 2.17 if you manage Supervisor namespaces with Terraform. The unreleased 2.18.0 replaces the storage_policies attribute on vsphere_namespace with storage_policy blocks. 2.17.1 is still the latest release, so nothing has changed yet, but it's worth pinning before it lands.
  • Lab Convert lab clusters to vLCM images before you try VCF 9. Baselines were removed in vSphere 9.0, and Dr Pranay Jha's write-up notes the VCF 9 installer's validation fails for a baseline-managed cluster. Converting doesn't reboot anything; remediation does. Today's deep dive has the rest.

Security Advisories Latest four

No new VMSA today, so these are the four most recently released or updated advisories; Broadcom's advisory portal has the rest. VMSA-2026-0008.1 is still at revision .1 with every SDDC Manager fix "Patch pending", and Broadcom's portfolio statement KB 460791 still says no other product is critically affected. vCenter CVE-2026-59310 (VMSA-2026-0006) remains the most important patch if you haven't applied it. The Linux kernel TCP flaw CVE-2026-98432 still has no Broadcom impact statement.

VMSA-2026-0008.1 Critical Open Rev .1 · 28 Oct 2026

Node.js, as used in SDDC Manager, has a Brotli decoder out-of-bounds write that an attacker with network access to SDDC Manager could use to run code. It is critical (9.8) on SDDC Manager 9.1.1 and important (7.5) on 9.0.x, 9.1.0 and 5.2.x; revision .1 on 28 Oct clarified that only SDDC Manager is affected. Every fixed version is still "Patch pending". Broadcom's portfolio statement KB 460791 says none of its other products is critically affected. Sophos [Press] and earlier press reports say CISA added the underlying Brotli flaw to its KEV catalogue on 27 Oct; the Broadcom advisory itself makes no statement on exploitation. Issue date 27 Oct 2026.

  • CVE-2026-111497 9.8 SDDC Manager Node.js Brotli · 9.8 on 9.1.1, 7.5 elsewhere · reported KEV 27 Oct

DoApply KB 460732 on 9.1.1 or KB 460734 on 9.0.x, 9.1.0 and 5.2.x, restrict SDDC Manager to trusted admin hosts, and subscribe to the advisory for the patch.

VMSA-2026-0007 Critical Open Initial · 3 Sep 2026

For desktop hypervisors: Workstation 25H2 and 26H1 and Fusion 25H2 and 26H1, CVSSv3 8.1 to 9.3. Both CVEs need local admin rights inside a guest and can lead to code execution on the host. There are no workarounds and the advisory makes no statement on exploitation.

  • CVE-2026-59346 9.3 VMXNET3 integer overflow
  • CVE-2026-59347 8.1 HGFS stack overflow

DoUpdate Workstation and Fusion to 26H1u1, especially if you run nested labs on a laptop.

VMSA-2026-0006.2 Critical Exploited Open Rev .2 · 19 Aug 2026

Still the one to prioritise. It covers vCenter, ESX, Workstation and Fusion (and so VCF, VVF and Telco Cloud), CVSSv3 2.7 to 9.8, with no workarounds. CISA added vCenter CVE-2026-59310 to its KEV catalogue on 18 Aug 2026 with known ransomware use. Security Affairs [Press] reports CISA added the ESX logging flaw CVE-2026-41709 on 28 Oct with a federal deadline of 11 Nov; it has its own fixed builds in the matrix. The Broadcom advisory itself makes no statement on exploitation. First published 29 Jul 2026.

  • CVE-2026-59309 9.8 vCenter VMDir auth bypass
  • CVE-2026-59310 9.8 vCenter Syslog traversal · KEV
  • CVE-2026-47876 9.3 ESX VMXNET3
  • CVE-2026-41703 7.6 ESX OOB read
  • CVE-2026-41709 2.7 ESX logging · reported KEV 28 Oct

DoPatch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f (VCF 5.x: async patch to 8.0 U3k per KB 88287). On ESX 9.0, ESXi-9.0.2.0100-25595025 covers all three ESX CVEs. On 9.1 the matrix lists ESXi-9.1.0.0200-25557999 for CVE-2026-47876 and ESXi-9.1.0.0-25370933 for the other two. On 8.0, ESXi80U3k-25595708 fixes CVE-2026-47876, U3i-25205845 CVE-2026-41703 and U3j-25429389 CVE-2026-41709; ESXi80U2f-25626445 covers only CVE-2026-47876. For VCF 5.x the matrix lists 5.2.4 for CVE-2026-41709.

VMSA-2026-0005.1 Critical Open Rev .1 · 7 Aug 2026

If you run Avi Load Balancer (including for VKS or VCF Automation), this one matters. Seven CVEs, CVSSv3 7.1 to 9.8, no workarounds; the worst, CVE-2026-47865, is an authentication bypass on the Avi control plane. The advisory makes no statement on exploitation. First published 14 Jul 2026; revision .1 on 7 Aug added the 22.1.7-2p12 patch.

  • CVE-2026-47865 9.8 control-plane auth bypass
  • CVE-2026-47871 8.8 directory traversal
  • CVE-2026-47867 8.7 RCE
  • CVE-2026-47869 8.7 authenticated RCE
  • CVE-2026-47866 8.3 authorisation bypass
  • CVE-2026-47868 7.8 local privilege escalation
  • CVE-2026-47870 7.1 privilege escalation

DoUpgrade 32.1.1 to 32.1.2 or later (the advisory's recommended version), 31.1.1–31.2.2 to 31.2.2-2p3, and 30.1.1–30.2.6 to 30.2.7. On 22.1.x, 22.1.7-2p12 fixes CVE-2026-47865, but the matrix lists 30.2.7 for the other six.

All VMware security advisories on Broadcom's support portal →

KB Articles & Known Issues Nothing new

No new VMware KBs worth flagging since Friday, and the ones we follow haven't moved. KB 460732 still names no fixed SDDC Manager version; KB 458671 (NSX Manager startup) and KB 452660 (SCRX after the 9.0.1 to 9.1.1 upgrade) still wait on an upcoming NSX release; KB 456305 still has a fix planned; KB 457944 still points to the next 9.1.1 release, though Supervisor 9.1.1.0100 already lists it as resolved; and KB 460199 still promises eMudhra fixes in upcoming releases.

Releases & Release Notes Nothing new

A quiet weekend on TechDocs, and still no SDDC Manager patch for VMSA-2026-0008. The 9.1.1.x patch index still shows the 12 October batch plus vSAN File Services 9.1.1.0200 (26 October), the Async Releases page has nothing newer, and the release notes index shows no 9.1.2 or 9.2 line. Avi Load Balancer is still on 32.1.4.

Automation & IaC

Terraform & Packer Nothing new

Nothing new from the providers or Packer plugins this weekend, so vcf 0.19.0 is still the one to use for VCF 9.1.1, per the README. The vsphere provider is still on 2.17.1, so the vsphere_namespace storage-policy change planned for 2.18.0 hasn't landed yet; pinning ~> 2.17 keeps you safe until you're ready to migrate.

Automation & API Ecosystem All quiet

PowerCLI 9.1.1 is still current on the PowerShell Gallery, and govmomi 0.56.2, pyVmomi 9.1.1.0 and the Ansible collections are unchanged. William Lam's VCF 9.1 Upgrade Planner write-up from 22 October is still the best primer if you're planning a 9.1.1 upgrade.

Deep Dive of the Day

vSphere Lifecycle Manager images in VCF 9, and what composite images add

If you're bringing older clusters into VCF 9, the first thing to check is how their hosts are patched. Baselines, the old Update Manager model of stacking patches onto hosts, were deprecated in vSphere 8.0, gained a supported conversion path in VCF 5.2.2 and were removed in vSphere and VCF 9.0. As Dr Pranay Jha's workshop write-up puts it, this is a hard gate rather than advice: the VCF 9 installer's validation fails for a baseline-managed cluster. An image is declarative instead: one desired state per cluster, made of a base ESX version, an optional vendor add-on, optional firmware and drivers delivered through a hardware support manager (HSM), and any extra components, enforced on every host.

In VCF 9 the workflow is split between two places, per the TechDocs page on managing vLCM images for VCF. You build the image in the vSphere Client, then import it into the VCF instance through VCF Operations. Once imported, it's what you pick when you create a workload domain, add a cluster to a domain, or upgrade a domain. If your fleet runs with an offline depot or no depot at all, you need the VCF Download Tool to bring in current ESX component data before you can build images in the vSphere Client.

The newer piece is composite images, which deal with the classic problem of a cluster that grew across hardware generations. A composite image has one default image plus additional image definitions, up to four, and every definition shares the same base ESX version and the same solutions. What can differ per definition is the vendor add-on, the firmware and the components, and each definition can have its own HSM attached. Hosts are matched to a definition either by hand or automatically from their System BIOS details: vendor, model, OEM string and family. That means a cluster with two server vendors, or two generations from one vendor, no longer forces you into a lowest-common-denominator image.

For the conversion itself, Jha's sequence is sensible: check the hardware against the Broadcom Compatibility Guide (and confirm you have an HSM if firmware will be in the image), fix any existing baseline non-compliance first, back up vCenter and record each host's build, drivers and firmware, then switch the cluster to a single image seeded from an existing host. Run a compliance check as a dry run and read the drift report before remediating host by host. Switching the cluster's lifecycle model doesn't reboot hosts or move VMs; remediation does. He also calls it a one-way door, since there's no going back to baselines on 9.0.

The gotchas are mostly about timing. Do the conversion before you deploy or converge into VCF 9, not during it, and don't start with hosts that are already non-compliant, or the before-and-after comparison becomes guesswork. The base version being fixed across a composite image also means a mixed cluster still upgrades ESX as one, so check every hardware vendor's add-on is available for the target release before you plan the window. In a nested lab the same installer check applies, so convert your nested clusters to an image before you point the VCF 9 installer at them.

Based on Managing vSphere Lifecycle Manager Images for VMware Cloud Foundation (TechDocs) Official Architect Workshop Series #1: Converting vSphere 8 Clusters to vLCM Images Before VCF 9 (Dr Pranay Jha) Community

Industry One change today

Licensing, Business & Industry News One change today

  • KB 456620: Announcing important changes being made to the VCSP Program Broadcom KB Effective 1 Nov Official From today, new VCSP contracts get the VCSP Commit programme type and move out of the Consumption Portal into the Support Portal's Licensing module, where you can split or merge keys with the same end date and control access with folders and permissions. You'll need the Product Administrator role to manage them; contracts booked before today stay in the Consumption Portal.

Community & Learning Latest episodes

Videos, Podcasts & Events Latest episodes

Sources (32)

Recent Briefings

Full archive → RSS

Tags: Official Broadcom and VMware sources, Press trade press, Community community posts and unverified reports.

Thanks for visiting

Let's talk tech!

Questions, ideas, or just want to talk VCF? Drop me an email or find me on the socials.

Email me →