Broadcom has published VMSA-2026-0008, covering a Node.js Brotli decoder vulnerability affecting VMware Cloud Foundation’s SDDC Manager. Tracked as CVE-2026-111497, the issue can allow a malicious actor with network access to SDDC Manager to execute arbitrary code. The severity depends on the SDDC Manager version not every affected release carries the same risk rating.
For VCF administrators, the immediate priorities are straightforward: identify your SDDC Manager version, follow the correct workaround, and verify the appliance afterward.
Which versions are affected?
Broadcom’s advisory lists the following affected versions. At the time of writing, its response matrix shows “Patch pending” for each, with interim workarounds available.
| SDDC Manager version | Severity | CVSSv3 score | Workaround |
|---|---|---|---|
| 9.1.1.x | Critical | 9.8 | KB 460732 |
| 9.0.x and 9.1.0 | Important | 7.5 | KB 460734 |
| 5.2.x | Important | 7.5 | KB 460734 |
The distinction matters: the advisory’s Critical rating applies specifically to SDDC Manager 9.1.1.x. Broadcom’s workaround article also states that SDDC Manager 5.1.x and earlier are not affected.
What is the vulnerability?
The issue is an out-of-bounds write in the Brotli decoder used by Node.js within SDDC Manager. Broadcom identifies arbitrary code execution as the potential impact.
Although this affects the management appliance rather than being described as an ESXi vulnerability, it still deserves attention. The advisory specifically identifies network access to SDDC Manager as part of the attack scenario.
Is there a permanent fix?
The advisory currently lists patches as pending. The procedures discussed here are an interim workaround, not a permanent software fix. Broadcom explicitly states that KB 460734 is temporary and intended only to address this CVE. Check the live advisory before making changes, because patch availability and instructions may change.
There are also two different workaround paths:
- SDDC Manager 5.2.x, 9.0.x and 9.1.0.x: follow KB460734.
- SDDC Manager 9.1.1.x: follow KB460732 instead.
Do not apply the pre-9.1.1 workaround to 9.1.1.x.