Security Advisories Latest four
There's no new VMSA today, so these are the four most recently released or updated advisories; Broadcom's advisory portal has the rest. VMSA-2026-0008.1 still lists "Patch pending" for every SDDC Manager version, and vCenter CVE-2026-59310 in VMSA-2026-0006 remains the most important fix if you haven't applied it. The OpenSSH flaw CVE-2026-123158 ("SSHole") is now being exploited, according to Help Net Security [Press], which cites attacks on an Alpine Linux honeypot; it only affects musl-based systems that don't use PAM, OpenSSH 10.6p2 fixes it, and it isn't in the CISA KEV catalogue. Broadcom hasn't published a statement on it, or on the Linux kernel TCP flaw CVE-2026-98432.
Node.js, as used in SDDC Manager, has a Brotli decoder out-of-bounds write that an attacker with network access to SDDC Manager could use to run code. It is critical (9.8) on SDDC Manager 9.1.1 and important (7.5) on 9.0.x, 9.1.0 and 5.2.x; revision .1 on 28 Oct clarified the impacted products in the response matrix. Every fixed version in the matrix is still "Patch pending", and the only SDDC Manager 9.1.1 patch on TechDocs, 9.1.1.0200, doesn't mention it. Broadcom's portfolio statement KB 460791 says SDDC Manager in VCF 9.1.1 is the only critically affected product. BleepingComputer [Press] reports CISA added the underlying Brotli flaw to its KEV catalogue on 27 Oct with a federal deadline of 10 Nov; the Broadcom advisory itself makes no statement on exploitation. Issue date 27 Oct 2026.
- CVE-2026-111497 9.8 SDDC Manager Node.js Brotli · 9.8 on 9.1.1, 7.5 elsewhere · reported KEV 27 Oct
DoApply KB 460732 on 9.1.1 or KB 460734 on 5.2.x, 9.0.x and 9.1.0, keep SDDC Manager reachable only from trusted admin hosts, and subscribe to the advisory so you see the patch the day it lands.
For desktop hypervisors: Workstation 25H2 and 26H1 and Fusion 25H2 and 26H1, CVSSv3 8.1 to 9.3. Both CVEs need local admin rights inside a guest and can lead to code execution on the host. There are no workarounds and the advisory makes no statement on exploitation.
- CVE-2026-59346 9.3 VMXNET3 integer overflow
- CVE-2026-59347 8.1 HGFS stack overflow
DoUpdate Workstation and Fusion to 26H1u1, especially if you run nested labs on a laptop.
Still the one to prioritise. It covers vCenter, ESX, Workstation and Fusion (and so VCF, VVF and Telco Cloud), CVSSv3 2.7 to 9.8, with no workarounds. CISA added vCenter CVE-2026-59310 to its KEV catalogue on 18 Aug 2026 with known ransomware use. Security Affairs [Press] reports CISA added the ESX logging flaw CVE-2026-41709 on 28 Oct with a federal deadline of 11 Nov; it has its own fixed builds in the matrix. The Broadcom advisory itself makes no statement on exploitation. First published 29 Jul 2026; revision .2 on 19 Aug added 7.0 patch guidance for the critical issues.
- CVE-2026-59309 9.8 vCenter VMDir auth bypass
- CVE-2026-59310 9.8 vCenter Syslog traversal · KEV
- CVE-2026-47876 9.3 ESX VMXNET3
- CVE-2026-41703 7.6 ESX OOB read
- CVE-2026-41709 2.7 ESX logging · reported KEV 28 Oct
DoPatch vCenter to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k / U2f (VCF 5.x: async patch to 8.0 U3k per KB 88287). On ESX 9.0, ESXi-9.0.2.0100-25595025 covers all three ESX CVEs. On 9.1 the matrix lists ESXi-9.1.0.0200-25557999 for CVE-2026-47876 and ESXi-9.1.0.0-25370933 for the other two. On 8.0, ESXi80U3k-25595708 fixes CVE-2026-47876, U3i-25205845 CVE-2026-41703 and U3j-25429389 CVE-2026-41709; ESXi80U2f-25626445 covers only CVE-2026-47876. For VCF 5.x the matrix lists 5.2.4 for CVE-2026-41709.
If you run Avi Load Balancer (including for VKS or VCF Automation), this one matters. Seven CVEs, CVSSv3 7.1 to 9.8, no workarounds; the worst, CVE-2026-47865, is an authentication bypass on the Avi control plane. The advisory makes no statement on exploitation. First published 14 Jul 2026; revision .1 on 7 Aug added the 22.1.7-2p12 patch.
- CVE-2026-47865 9.8 control-plane auth bypass
- CVE-2026-47871 8.8 directory traversal
- CVE-2026-47867 8.7 RCE
- CVE-2026-47869 8.7 authenticated RCE
- CVE-2026-47866 8.3 authorisation bypass
- CVE-2026-47868 7.8 local privilege escalation
- CVE-2026-47870 7.1 privilege escalation
DoUpgrade 32.1.1 to 32.1.2 or later (the advisory's recommended version), 31.1.1–31.2.2 to 31.2.2-2p3, and 30.1.1–30.2.6 to 30.2.7. On 22.1.x, 22.1.7-2p12 fixes CVE-2026-47865, but the matrix lists 30.2.7 for the other six.
All VMware security advisories on Broadcom's support portal →
Deep Dive of the Day Backing up the VCF 9.1 management stack: one SFTP target, several schedules and a few traps
Most of us set up backups once during bring-up and then forget about them until a patch or a failed appliance reminds us. In VCF 9.1 that's riskier than it used to be, because the management stack has grown well beyond SDDC Manager, vCenter and NSX. Broadcom's component backup page now lists a whole family of VCF management services alongside them: the VCF services runtime, SDDC lifecycle, fleet lifecycle, the software depot, the Identity Broker, Salt RaaS and Salt master, VCF Automation and Log Management. Each needs a plan, and they don't all use the same method.
The split is worth learning. SDDC Manager and vCenter can be protected with file-based or image-based backups, and Broadcom's documentation uses file-based for both. NSX Manager and the VCF management services are file-based, and NSX Edge configuration rides along inside the NSX Manager backup. VCF Operations and VCF Operations for networks are the exceptions: they need full image-based VM backups from a product that supports vSphere Storage APIs for Data Protection. A handful of services, including telemetry, the real-time metrics store and the migration service engine, are only captured as part of a scheduled backup, so an on-demand run alone won't cover them. And Log Management is file-based, but its log data isn't included in the backup, so you need to archive it separately.
Where you configure it has moved too. The SFTP target for the management services and VCF Automation is set in VCF Operations, and Broadcom describes it as a prerequisite for patching or upgrading those components, because the same target is used for the automatic backups taken during lifecycle operations. Out of the box, SDDC Manager and NSX Manager back up to the SDDC Manager appliance itself, with NSX set to back up hourly during bring-up. Broadcom recommends an external SFTP server instead, both because it's a prerequisite for restoring SDDC Manager from a file-based backup and because it separates your NSX backups from the appliance you might be restoring. vCenter has its own file-based schedule and SFTP settings.
Dr Pranay Jha's day-2 walkthrough is a good practical companion. He suggests daily SDDC Manager and vCenter backups with seven days' retention, keeping NSX hourly, and starting the SDDC Manager and vCenter jobs within the same few minutes so they make a consistent restore point. He also points out that a wrong SFTP host or credential propagates to every component, that a missing fingerprint prompt usually means port 22 is blocked, and that losing the encryption passphrase makes the backups useless, so keep it in your vault, not in your head.
Two production gotchas are worth knowing before you need a restore. KB 456587 describes backups of the SDDC lifecycle and VCF services runtime components failing straight after an SFTP target was added to a new VCF 9.1.1 deployment, which Broadcom puts down to a space issue on the backup server, so size the target for the full retention window across every component rather than just SDDC Manager. Broadcom also recommends taking an on-demand backup before any upgrade, after a recovery, after fixing an incomplete SDDC Manager workflow and after any failed scheduled backup, which is a sensible habit to build into your change process.
In a nested lab, it's tempting to leave everything on the SDDC Manager appliance. A small Linux VM with an SFTP account on the management network costs very little and lets you rehearse the restores you'd rely on in production. It also means your patch runs won't stall on a missing backup target. On vSphere Foundation, which has no fleet management UI, Broadcom points you to the fleet lifecycle API for backing up and restoring the management services instead.
Based on Component Backup and Restore of VMware Cloud Foundation 9.1 (Broadcom TechDocs) Official Configure Backup Target and Schedules in VMware Cloud Foundation 9.1 (Broadcom TechDocs) Official KB 456587: VCF 9.1.1.0 management services backup fails using SFTP server Official How to configure SDDC Manager and fleet backups in VCF 9.1 (Dr Pranay Jha)
