Affected product(s):
| Product | Affected versions | CVSS v3 | Fixed version |
| VMware Cloud Foundation – SDDC Manager | 9.1.1.x | 9.8 (critical) | Not yet available |
| VMware Cloud Foundation – SDDC Manager | 9.0.x and 9.1.0 | 7.5 (high) | Not yet available |
| VMware Cloud Foundation – SDDC Manager | 5.2.x | 7.5 (high) | Not yet available |
Description
A critical vulnerability has been published in the SDDC Manager component of VMware Cloud Foundation (CVE-2026-111497): an out-of-bounds write in the Node.js Brotli decoder that allows an attacker with network access to SDDC Manager to execute arbitrary code. The vendor rates it with CVSS v3 of up to 9.8 (critical), a score that applies only to version 9.1.1.x.
For 9.1.1.x, the vendor assigns a CVSS v3 score of 9.8 (network vector and low attack complexity). For versions 9.0.x, 9.1.0 and 5.2.x, it assigns a CVSS v3 score of 7.5 (high), with an adjacent network vector and high attack complexity; these versions remain affected, although not critically.
This is the same Brotli vulnerability addressed in Alert 2026-124 (Node2Shell/HTTP2Shell) and Alert 2026-125 (Palo Alto PAN-OS). CVE-2026-111497 has been listed in the Known Exploited Vulnerabilities (KEV) catalog since 10/27/2026, with a remediation deadline of 11/10/2026. The vendor’s advisory does not mention exploitation targeting VMware Cloud Foundation.
The vendor indicated that a fixed version is not yet available and did not provide a publication date.
Mitigation
Until the fix is released, the vendor offers two temporary measures, applicable only to this vulnerability. Both require backing up the SDDC Manager appliance beforehand.
- SDDC Manager 9.1.1.x (KB460732): an nginx rule and middleware are added to the user interface application to reject requests with the Content-Encoding: br header using status code 415. nginx must be reloaded and the sddc-manager-ui-app service restarted (not the appliance).
- SDDC Manager 5.2.x, 9.0.x and 9.1.0 (KB460734): zlib.createBrotliDecompress is disabled in the user interface service by using the NODE_OPTIONS variable. The sddc-manager-ui-app service must be restarted. The article is written for 5.2.x, 9.0.2 and 9.1.0 (its title cites 5.2.4, 9.0.2 and 9.1.0).
As a general Beacon Lab recommendation, network access to SDDC Manager should be restricted to only the networks and administrators that require it.
Solution
The vendor’s fix is not yet available. The patch should be applied as soon as it is released.
Additional information:
- Broadcom — security advisory VMSA-2026-0008 (issued on 10/27/2026, revision .1 dated 10/28/2026):
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39445 - Broadcom — KB460732, temporary mitigation for SDDC Manager 9.1.1.x:
https://knowledge.broadcom.com/external/article?articleNumber=460732 - Broadcom — KB460734, temporary mitigation for SDDC Manager 5.2.x, 9.0.2 and 9.1.0:
https://knowledge.broadcom.com/external/article?articleNumber=460734 - CISA — Known Exploited Vulnerabilities (KEV) catalog:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog - Beacon Lab — Alert 2026-124, critical vulnerability in Node.js (Node2Shell):
https://beaconlab.us/publicacion/alerta-2026-124-vulnerabilidad-critica-en-node-js-node2shell/ - Beacon Lab — Alert 2026-125, critical vulnerabilities in Palo Alto PAN-OS (Brotli and PHP2Shell):
https://beaconlab.us/publicacion/alerta-2026-125-vulnerabilidades-criticas-en-palo-alto-pan-os-brotli-y-php2shell/