Do Son 
TL;DR
Broadcom has issued VMSA-2026-0008 for a critical VMware SDDC Manager vulnerability, tracked as CVE-2026-111497. The flaw scores 9.8 on CVSS v3 in SDDC Manager 9.1.1. It stems from the same Brotli vulnerability that CISA added to its KEV catalog on October 27.
A bug in the Node.js Brotli decoder lets attackers run code on SDDC Manager. Patches are still pending, but Broadcom offers workarounds. Apply them now.
- CVE: CVE-2026-111497
- CVSS: 9.2 (Critical · CVSSv4)
- Product: Google Brotli
- Affected: 1.0.3, 1.1.0, 1.2.0
- Impact: Out-of-Bounds Write in Google Brotli Decoder
- Status: Exploited in the wild
- Patched in: 1.0.10, 1.1.1, 1.2.1
- EPSS: 55.5% (30-day)
- Action: Update to 1.0.10, 1.1.1, 1.2.1 now
Why It Matters
SDDC Manager handles lifecycle tasks across VMware Cloud Foundation. As a result, a takeover could give an attacker a strong foothold in the private cloud.
Moreover, CISA confirmed active exploitation of this Brotli vulnerability on October 27. CISA’s entry covers the library in general. Broadcom has not reported attacks against SDDC Manager itself.
How the Attack Works
Broadcom explains that “Node.js as used in SDDC manager contains a remote code-execution vulnerability due to an out-of-bounds write issue in Brotli decoder.”
The advisory adds, “A malicious actor with network access to SDDC Manager may exploit this issue to execute arbitrary code.” According to the CVE record, the attacker sends a crafted Brotli-compressed stream to corrupt decoder memory.
Affected Versions
The VMware SDDC Manager vulnerability affects three branches in VMware Cloud Foundation and vSphere Foundation:
- SDDC Manager 9.1.1: CVSS 9.8, Critical
- SDDC Manager 9.0.x and 9.1.0: CVSS 7.5, Important
- SDDC Manager 5.2.x: CVSS 7.5, Important
Notably, Broadcom says “this critical score applies only to SDDC Manager 9.1.1.x; older releases are not critically impacted.”
Patch and Mitigation
Every fixed version in the response matrix still reads “Patch pending.” Until patches for this VMware SDDC Manager vulnerability arrive, follow KB460732 for 9.1.1 and KB460734 for older branches. Also, limit network access to SDDC Manager to trusted admin hosts.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
