Strengthening the Programmable Infrastructure: Security and Hardening in VCF 9.1.1

In our previous post, Unlocking the Full Potential of Programmable Infrastructure with VMware Cloud Foundation 9.1, we explored the exciting new features and capabilities designed to help you scale and automate private cloud environments. Today, we are expanding the  conversation to a critical pillar of modern IT operations: Security and Resilience.

As threat landscapes evolve, including the emergence of advanced vulnerability risks linked to bad actors using tools and AI agents fueled by frontier AI models —your automation platforms must remain resilient. VMware Cloud Foundation (VCF) 9.1.1 is a dedicated, security-focused maintenance release aimed at addressing potential vulnerabilities, hardening certificate validation, upgrading core dependencies, and providing clearer diagnostics for mission-critical automation pipelines.

Here is what developers can expect across the VCF SDK, VCF PowerCLI, and our latest Terraform Provider updates.

VMware Cloud Foundation SDK 9.1.1

(Build 25714914 | Java and Python | Released September 3, 2026)

VCF SDK 9.1.1 is designed to strengthen security and resilience of modern IT operations. While no new components or samples have been added, several foundational dependent libraries have been aggressively upgraded to reduce exposure to known security risks.

Java SDK: Dependency Upgrades & Modernization

To ensure the strongest security posture for applications consuming the VCF SDK, we have implemented critical updates to our Java ecosystem:

• Java Version Requirements: Java 17 is now the absolute minimum requirement. The SDK is fully compatible with Java Long Term Support (LTS) versions 17, 21, and 25. We strongly recommend migrating to one of these LTS releases when integrating the SDK into custom applications.
• Apache CXF Upgrade: The VCF Java SDK modules for vSphere and vSAN SOAP APIs (including vim25, pbm, sms, ssoclient, vslm, and eam) have been upgraded to Apache CXF 4.1.7. This patches known CVEs and ensures compatibility with modern, well-supported frameworks like Jakarta EE 10, Spring 6, and Spring Boot 3.

Python SDK: Lifecycle Security Alignment

Maintaining a secure Python environment requires running actively maintained versions that receive security patches from the Python Software Foundation (PSF).

• Version Compatibility: The VCF Python SDK in release 9.1.1.0 officially supports Python versions 3.10, 3.11, 3.12, 3.13, and 3.14.
• EOL Deprecation: As a best practice, once a Python version reaches End-Of-Life (EOL), the VCF Python SDK will no longer provide compatibility guarantees for it. Ensure your environments are updated to Python 3.10 or higher.

Resolved SDK Issues (pyVmomi Type Hints)

This release also brings much-needed quality-of-life improvements for Python developers relying on pyVmomi:

• Eliminated Name Collisions: Fixed collisions in type hint stubs where multiple packages defined classes with the same short name (e.g., ConfigInfo). Cross-package and standard library references are now fully qualified, ensuring correct type resolution.
• Corrected vmodl.MethodFault Stub: The stub now accurately inherits from both Exception and DynamicData. Previously, it only declared Exception, which caused strict type checkers to reject valid attribute access.
• Cleaned Up Ghost Classes: Removed empty vmodl.DataObject and vmodl.ManagedObject type hint classes that erroneously overrode actual class definitions, restoring accurate type resolution.

VCF PowerCLI 9.1.1

(Build 25718932 | Released September 10, 2026)

VCF PowerCLI 9.1.1 focuses heavily on delivering a more secure automation platform, prioritizing hardened certificate validation and robust error diagnostics.

Image Builder & Core Lifecycle Security

• Embracing Python 3.14: The Image Builder module now officially supports Python 3.14, empowering customers operating under strict compliance frameworks to safely patch and update.
• Removal of Python support for 3.7 – 3.9: In alignment with official Python lifecycle policies, we removed support for versions 3.7, 3.8, and 3.9. Ensure you update your environments to Python 3.10 or higher.
• PowerShell Core Baseline: To maintain compliance with modern security and stability standards, we raised the minimum supported version of PowerShell Core to 7.0.13.

Resolved PowerCLI Issues

We’ve improved execution resilience and diagnostic clarity across several cmdlets:

• Secure Console Access: We updated Open-VMConsoleWindow to resolve connection failures when interacting with modern servers utilizing the latest certificate checksum algorithms.
• Resilient Network Adapters: Fixed a NullReferenceException in New-NetworkAdapter that occurred when supplying invalid MAC addresses.
• Smarter Content Libraries: Content Library cmdlets now surface exact server-side failure messages rather than generic errors. Furthermore, diagnostic accuracy has been vastly improved when handling SSL certificate thumbprint mismatches during subscription synchronization.

Terraform Provider for vSphere

(Release 2.17.0 | Released September 01, 2026)

Rounding out the infrastructure-as-code updates, the Terraform Provider for vSphere recently received its 2.17.0 update. This release brings powerful new resources that perfectly complement the latest VCF hardening efforts.

New Features for Identity & Network Management

• vCenter SSO Management: We have introduced new resources and data sources (r/sso_user, r/sso_group). This allows you to natively manage vCenter Single Sign-On users and groups directly via Terraform.
• Network Protocol Profiles: A highly requested new resource (r/network_protocol_profile) allows you to seamlessly manage vSphere network protocol profiles (IP pools).
• Datastore Paths: Added a new optional datastore_path attribute to the r/virtual_machine resource for more granular provisioning control.

OVF & VM Improvements

• Datastore Cluster Enhancements: You can now deploy an OVF/OVA directly to a datastore cluster using the datastore_cluster_id attribute. We’ve also extended this support to the d/ovf_vm_template data source for extracting OVF hardware settings.
• VM Folder Visibility: The virtual machine data source (d/virtual_machine) now successfully exposes the virtual machine folder attribute, simplifying environment queries.

Programmable infrastructure is only as powerful as it is secure. Upgrading to VCF SDK, VCF PowerCLI 9.1.1, and the latest Terraform provider keeps your automation pipelines compliant and resilient.

Be sure to check the official VMware Cloud Foundation Documentation for complete Release notes, API Change log and keep an eye for more blogs related to VCF automation consumption layer!