VMSA-2026-0008: SDDC Manager has a critical flaw and no patch yet
CVE-2026-111497 sits in the Node.js runtime inside SDDC Manager. It is rated 9.8 on 9.1.1, CISA lists it as exploited, and every version is still waiting on a patch. What the workaround does and what to do this week.