MDR
Solutions
Partners
About
Resources
Affected Environment
SDDC Manager in VMware Cloud Foundation and VMware vSphere Foundation on any platform, where an attacker has network access to SDDC Manager:
Threat Overview
CVE-2026-111497 is a critical out-of-bounds write in the Google Brotli decoder that affects the Node.js component used by SDDC Manager. A remote attacker with network access to SDDC Manager may be able to execute arbitrary code.
Exposure Timeline
Report issued 28 October 2026, based on the Broadcom security advisory. Broadcom workarounds are available; the report refers to a permanent fix as one to apply once it becomes available.
Attack Surface
SDDC Manager management interfaces reachable over the network, particularly from untrusted networks.
Technical Root Cause
The Brotli decoder mishandles invalid block-type switches, which can cause writes beyond an eight-byte internal buffer and memory corruption (CWE-787 and CWE-252). The upstream fix adds a dedicated format-error code to reject invalid block switches.
Exploitation Pathway
An attacker supplies crafted compressed data to the vulnerable component and, under suitable conditions, achieves remote code execution.
Operational Impact
Remote code execution on the SDDC Manager, which administers VMware Cloud Foundation infrastructure, with potential for service crashes and further compromise.
Strategic Impact
Risk is rated Critical for large and medium government entities and businesses, and High for small government entities and businesses.
Required Mitigation
Identify SDDC Manager versions (9.1.1.x, 9.1.0, 9.0.x and VCF 5.2.x) and apply the matching Broadcom workaround: KB460732 for 9.1.1.x, KB460734 for the older releases. Back up configurations before applying workarounds and follow the vendor's instructions. Apply the Broadcom permanent fix as soon as it is available and verify remediation. Restrict management-plane access to authorised administrative networks and trusted hosts, and isolate management interfaces from internet-facing systems.
Incident Response Guidance
Review firewall, application and system logs for suspicious requests and unexpected access to SDDC Manager. Investigate unexplained service crashes, restarts, abnormal processes and unexpected outbound connections, and preserve logs while correlating network and endpoint telemetry if compromise is suspected.
References
Broadcom security advisory 39445: support.broadcom.com. CVE-2026-111497.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)