Security bulletins

This document describes all security bulletins related to VMware solution on Google Cloud.

Use this XML feed to subscribe to security bulletins for this page.

GCP-2026-079

Published: 2026-11-05

Description

Description	Severity	Notes
Per advisory VMSA-2026-0008, Broadcom has identified an out-of-bounds write remote code execution vulnerability in the SDDC Manager Node.js Brotli decoder. This impacts only VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x and does not impact Google Cloud VMware Engine. What should I do? To remediate, apply the Broadcom-recommended workarounds outlined in the VMSA-2026-0008 advisory.	Critical	VMSA-2026-0008 CVE-2026-111497

Severity

Notes

Per advisory VMSA-2026-0008, Broadcom has identified an out-of-bounds write remote code execution vulnerability in the SDDC Manager Node.js Brotli decoder. This impacts only VMware solution on Google Cloud running VMware Cloud Foundation 9.1.x and does not impact Google Cloud VMware Engine.

What should I do?

To remediate, apply the Broadcom-recommended workarounds outlined in the VMSA-2026-0008 advisory.

Critical

VMSA-2026-0008
CVE-2026-111497

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-11-05 UTC.