Security · October 31, 2026
Severe Vulnerability Discovered in VMware Cloud Foundation
A severe vulnerability has been identified in the management component SDDC Manager of VMware Cloud Foundation, stemming from third-party software. A fix is currently being prepared.
Broadcom released a security advisory on October 28, 2026, revealing that the vulnerability CVE-2026-111497 affects the data compression library Brotli. The library is utilized in the Node.js environment within SDDC Manager, which raises concerns that arbitrary code may be executed if access to SDDC Manager is possible over the network.
The company has rated the usage environment of SDDC Manager version 9.1.1 with a base score of 9.8 on the Common Vulnerability Scoring System CVSSv3.1, categorizing its severity as Critical, the highest level. However, for version 9.1.0 and earlier, as well as other branches, the CVSS base score is 7.5, marking its severity as Important, one level lower.
This vulnerability highlights the ongoing challenges in cybersecurity and the importance of timely patches to protect systems from potential exploits.