What happened
Broadcom published security advisory VMSA-2026-0008 on 27 October 2026, with the support-portal notification last updated on 28 October. The advisory concerns CVE-2026-111497, described as a Node.js Brotli decoder out-of-bounds-write remote-code-execution vulnerability. The affected product family is VMware Cloud Foundation, with the response matrix also covering VMware vSphere Foundation where SDDC Manager is deployed.
Broadcom says that Node.js as used in SDDC Manager contains the vulnerability because of the out-of-bounds write in the Brotli decoder. Its stated attack condition is network access to SDDC Manager: a malicious actor with that access may exploit the issue to execute arbitrary code. The advisory does not describe exploit code, an observed exploitation campaign, or a specific deployment path beyond that network-access condition.
Severity differs by SDDC Manager release. For VMware Cloud Foundation and VMware vSphere Foundation SDDC Manager 9.1.1, Broadcom assigns CVSSv3 9.8 and Critical severity. It explicitly says the critical score applies only to the 9.1.1.x line and that older releases are not critically impacted at that level. The matrix rates SDDC Manager 9.0.x and 9.1.0 Important at CVSS 7.5. It also rates VMware Cloud Foundation SDDC Manager 5.2.x Important at CVSS 7.5.
The operational complication is that Broadcom lists the fixed version as “Patch pending” for every affected row. For 9.1.1, the response matrix points to KB460732 under workarounds. For 9.0.x, 9.1.0, and 5.2.x, it points to KB460734. Broadcom’s resolution language says to apply patches listed in the response matrix once available, while its introduction says workarounds are available to remediate the issue in affected products. The supplied advisory excerpt does not reproduce the contents of either knowledge-base article, so this note cannot establish the precise interim configuration or procedure.
For operators, this is not merely an upstream-library notice. Broadcom has evaluated the issue in a management-plane component, mapped it to supported product and release lines, and supplied product-specific workaround references while patches remain unavailable. Teams should therefore treat the installed SDDC Manager version and its network exposure as the immediate facts to verify, rather than assuming that an upstream Brotli update alone resolves the appliance-level issue.
What the archive adds
This is a new affected-product disclosure in a known vulnerability story. Earlier notes covered the upstream fix releases for CVE-2026-111497 in Brotli, broader deployment guidance for Node.js, Bun, Envoy, and Istio in Patch the Planet’s disclosure, and a separate Node.js advisory affecting Node.js 22, 24, and 26 in the Node.js note. Broadcom now identifies SDDC Manager-specific exposure, severity, and workaround references.
Trend signal
No supplied New Runtime pattern genuinely fits this product-security advisory closely enough to support a pattern claim.
Why now
The timing is driven by Broadcom’s 27 October initial advisory for CVE-2026-111497. The vendor has issued version-specific severity assessments and workaround references before listing a fixed product version, leaving affected administrators with an interim mitigation period rather than a normal patch-and-close cycle.
Connections to other events
The advisory extends the same CVE-2026-111497 supply-chain story already documented in the archive. The earlier Brotli and Node.js notes establish that the decoder flaw reached multiple software surfaces; Broadcom’s notice adds VMware SDDC Manager as a named management-plane surface. It does not establish that the affected VMware releases share the same remediation process as Node.js, Bun, Envoy, or Istio.
Why it matters
Teams building with AI often focus on application dependencies and model-facing services, but the surrounding infrastructure is part of the production system too. VMware Cloud Foundation and vSphere Foundation operators may use SDDC Manager to administer the environments on which internal platforms and AI workloads run. A remotely exploitable management component can have a larger operational blast radius than an isolated application process because it sits near infrastructure administration.
The practical consequence is to separate confirmed facts from assumed remedies. Broadcom has confirmed affected release families, the network-access attack condition, and the current absence of listed fixed versions. It has not, in the supplied material, provided a universal package command or appliance-update procedure. Teams should use the vendor’s relevant workaround reference, inventory the listed versions, and keep patch planning ready for when Broadcom fills the “Patch pending” entries.
What happens next
- Broadcom will publish fixed versions or further remediation guidance for at least one affected SDDC Manager line. (3 months, 80%). Watch for: a response-matrix change from “Patch pending” to a versioned fix.
- Operators will need to revise interim mitigation plans when product patches arrive. (3 months, 75%). Watch for: updated KB460732 or KB460734 guidance.
Limits and uncertainty
This note relies on Broadcom’s advisory excerpt. It establishes that a network-access attacker may execute arbitrary code, but it does not establish whether the flaw is being exploited in the wild, how many deployments are exposed, or whether every installation of the listed versions is reachable from an attacker-controlled network. The excerpt names KB460732 and KB460734 as workaround references but does not include their contents, so it cannot safely restate mitigation steps. It also does not provide patch dates, fixed build numbers, or an end-of-support assessment for the affected releases.
Skill to build now
Create a short, owner-assigned exposure record for infrastructure control planes: product, installed release, reachable network paths, vendor advisory, interim workaround status, and patch status. For this advisory, start with SDDC Manager 9.1.1, 9.1.0, 9.0.x, and 5.2.x, then record whether the team has applied the relevant Broadcom workaround reference. This makes it possible to replace a temporary mitigation with a vendor patch without rediscovering who owns the system.
Reader takeaway
CVE-2026-111497 is now a VMware SDDC Manager issue as well as an upstream Brotli and Node.js issue. Broadcom rates SDDC Manager 9.1.1 as Critical at CVSS 9.8, lists older affected lines as Important, and has not yet listed fixed versions. Verify exposure and use the vendor’s product-specific workaround guidance while monitoring for patches.
Open question
When will Broadcom publish fixed versions for each affected SDDC Manager line, and what exact interim controls do KB460732 and KB460734 require?