VMware Cloud Foundation 9.1.1 is now available. Released on September 3, 2026, this maintenance release brings an updated Bill of Materials along with several meaningful improvements for security, networking, lifecycle management, VCF Operations, and VCF Automation.
While this is not a major platform release on the scale of VCF 9.1, there is plenty here for administrators to pay attention to. The biggest themes are improved supportability, more centralized management, and fewer manual day-two operations.
Automated Secure Boot key remediation
One of the most important security additions addresses the expiration of older Microsoft Secure Boot certificates. VCF 9.1.1 introduces three coordinated capabilities:
- A vCenter alarm identifies powered-on, Secure Boot-enabled virtual machines with an outdated NULL Platform Key.
- ESX can silently update the key during a guest reboot for Secure Boot VMs that do not use a virtual TPM.
- Windows VMs with a vTPM can use a capsule-based update process that preserves TPM-dependent applications.
The capsule workflow requires VMware Tools 13.1.5 and, for most supported Windows versions, the July 2026 Windows cumulative update or later. This gives administrators a much more visible and automated way to remediate Secure Boot keys across a VCF environment.
VM affinity and anti-affinity through compute policies
vCenter 9.1.1 expands compute policies with VM-to-VM affinity and anti-affinity rules. Administrators can keep related VMs together for lower latency or distribute them across hosts for better resiliency.
The policies apply to traditional virtual machines as well as VMs deployed through VM Service. Rules can be required or preferred during initial placement, although only preferred behavior is supported during runtime.
VCF Operations becomes a stronger management control plane
VCF Operations receives some of the most substantial improvements in this release.
Expanded certificate management
Certificate management now covers additional components including NSX appliances, cloud proxies, the license server, VCF Operations for Networks collectors, Security Token Service, vSphere Supervisor, vSAN storage, and VCF Automation.
Administrators can renew or replace expiring certificates from VCF Operations without accessing each component through SSH. The platform can generate expiration alarms, replace certificates with VMCA-signed certificates, detect self-signed certificate authorities, and automatically remove unused certificates during the upgrade.
Expanded password management
VCF Operations now manages additional operating-system and application accounts, including administrator@vsphere.local and the SDDC Manager root, admin@local, and vcf accounts.
The interface displays the last password update, reports account-lockout status, generates lockout alerts, and audits account operations. Password policies can also be managed for VCF Automation, VCF Operations for Networks, and cloud proxies.
Configuration management with VMware Salt
A new VMware Salt for VCF Components API provides a programmatic way to manage designated configuration settings across the VCF stack. This creates a useful foundation for desired-state configuration and configuration-drift automation.
Additional VCF Operations improvements
- Automated log configuration and collection for SDDC Manager.
- Outbound proxy settings when deploying a cloud proxy.
- On-demand Active Directory user and group lookup.
- IPv6 support for the VCF license server.
- Fleet-wide tag-management APIs.
- Improved licensing error messages with remediation guidance.
Organizations using SAML should re-import the identity broker service-provider metadata after upgrading. The new metadata recommends RSA-OAEP with SHA-256 for encrypted SAML assertions.
Major NSX networking enhancements
NSX 9.1.1 includes several capabilities that go well beyond routine maintenance.
Active/active EVPN route controllers
EVPN route controllers in Distributed Transit Gateway topologies can now use an active/active design. Each active controller establishes an independent BGP session with the external EVPN gateways, improving availability during failures and maintenance.
EVPN-VXLAN Direct Prefix Routing
Distributed VXLAN connectivity now supports Direct Prefix Routing. Selected traffic can travel directly between an ESX VTEP and a physical VXLAN leaf-switch VTEP instead of passing through the EVPN gateway.
The feature can be enabled for latency-sensitive storage traffic such as NFS and S3-compatible object storage while other traffic continues to use the standard EVPN gateway path.
More services for distributed connectivity
NAT, load balancing, and DHCP relay can now be used with EVPN-VXLAN distributed connectivity. Multi-tenant external connectivity is also supported for VCF Automation and vSphere Supervisor.
Additional NSX improvements include CPU allocation profiles for Edge nodes, sharing a vSphere Distributed Switch across multiple clusters in a VCF domain, and DHCP relay for public subnets in distributed VPC environments.
Native object storage enters technical preview
VCF 9.1.1 introduces a technical preview of native S3-compatible object storage built directly into vSAN. The goal is to provide scalable, multi-tenant object storage without requiring a separate third-party storage platform.
Because this is a technical preview, it should be evaluated in a lab and not treated as a production-ready service. The release also adds validated Cloud Native Storage support across additional vSAN storage topologies.
A smaller VCF management footprint
VCF management services require fewer compute and memory resources in 9.1.1. For new fleet and VCF instance deployments, VCF Installer now defaults to the Small deployment size instead of Medium.
The Small size retains the full feature set and is designed for production environments that require high availability. This should be particularly valuable for smaller deployments, edge environments, and homelabs where management overhead directly reduces available workload capacity.
VLAN-backed VPCs in VCF Automation
VCF Automation can now consume VLAN-backed VPCs. In this model, traffic uses physical VLANs directly rather than overlay encapsulation.
This provides another option for environments that need straightforward physical-network integration or cannot use overlays. Private networks are not supported because addressing is limited to the CIDRs backed by the physical VLANs.
Administrators should also note that native management capabilities for AWS, Microsoft Azure, and Google Cloud resources are deprecated and disabled by default in VCF Automation 9.1.1. Custom Terraform providers are not affected.
Upgrade and patching considerations
New VCF and vSphere Foundation environments can be deployed directly at 9.1.1. Supported VCF 5.2.x and 9.0.x environments can upgrade directly, while VCF 9.1.0.x environments can patch to 9.1.1.x.
The upgrade has an important starting point: patch the VCF management-services fleet-lifecycle component to 9.1.1 before patching other components. Additional dependencies apply to the software depot, identity broker, Salt RaaS, and the VCF Automation migration-service engine.
VCF Operations should be upgraded separately rather than in parallel with the other VCF components. Verify that its upgrade completes successfully before continuing with the remaining components.
Final thoughts
VCF 9.1.1 is best viewed as a practical operational release. Its strongest improvements address recurring day-two challenges: certificate and password management, Secure Boot remediation, configuration consistency, log collection, networking resiliency, and management-resource consumption.
The NSX and VCF Operations enhancements are substantial enough to make this release interesting beyond its collection of fixes. Before upgrading, review the component-specific known issues and plan the required fleet-lifecycle-first sequence carefully.