SDDC Manager and Brotli: Broadcom publishes mitigations while preparing patches
INCIBE warns of CVE-2026-111497 in Brotli integrated into Node.js and its impact on SDDC Manager. Exploitation of Brotli does not confirm attacks specifically targeting SDDC Manager.
News summary
On 28 October, INCIBE-CERT published advisory INCIBE-2026-800 about an out-of-bounds write in Brotli, integrated into Node.js. Broadcom identifies possible code execution with network access to SDDC Manager. The scope includes SDDC Manager 9.1.1, 9.1.0 and 9.0.x in VMware Cloud Foundation/vSphere Foundation, and 5.2.x in VMware Cloud Foundation.
At the time of the advisory, final patches were pending. INCIBE refers to KB460732 for 9.1.1.x and KB460734 for certain earlier versions. The advisory confirms exploitation of the Brotli vulnerability, not specifically of SDDC Manager. Businesses must make that distinction before assessing the state of their private infrastructure.
Source: INCIBE-CERT — 28 October 2026
What to review in your business
Identify the exact version and use only the mitigation applicable to it. Back up the configuration and review which services require checking or restarting.
Reduce access to the management plane and follow VMSA-2026-0008 for the final patches. A temporary mitigation requires follow-up, rather than closing the maintenance task as though it were a final update.
Concepts mentioned in this article: Cloud · Vulnerability
At Seintec, we help you organise maintenance for your computers and servers, check versions and plan changes. Contact our team.
Contact Seintec