CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on 2026-10-28. It is an insufficient logging flaw in Broadcom VMware ESX. According to the vendor, a malicious administrator could exploit it to perform certain operations without those operations being logged.
What Is It
CVE-2026-41709 is an insufficient logging vulnerability (CWE-778) in VMware ESX. According to the vendor description, "a malicious administrator could exploit this issue to perform certain operations without them being logged." The vendor does not say which operations are affected. NVD published the record on 2026-07-30, and NVD's status for it is still "Undergoing Analysis."
VMware rates it CVSS 3.1 2.7 (LOW) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. That means it is reachable over the network with low complexity but needs high privileges. Its only impact is low integrity impact.
Why It Matters
The base score is low, but CISA's KEV listing confirms active exploitation. CISA's SSVC assessment also lists exploitation as "active," automatable as "no," and technical impact as "partial."
The flaw needs admin access, so it is not a way in. Its risk comes after an attacker has privileged access to a host. At that point, some of the attacker's operations might not be logged, which could make investigation and incident response harder. Public information does not say which actions go unlogged or how much is missed. KEV lists known ransomware campaign use as "Unknown."
What's Vulnerable
Per the vendor-supplied NVD data:
- VMware ESX
- 9.1.x.x before ESXi-9.1.0.0-25370933
- 9.0.x.x before ESXi-9.0.2.0100-25595025
- 8.0 before ESXi80U3j-25429389
- VMware Cloud Foundation: 9.1.x.x, 9.0.x.x, and 5.x before 5.2.4
- VMware vSphere Foundation: 9.1.x.x and 9.0.x.x
- VMware Telco Cloud Platform: 5.1.x and 5.0.x
Patch Status
The affected version ranges above point to fixed ESX builds: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389. Cloud Foundation 5.x is fixed in 5.2.4. For the other products listed, see Broadcom's advisory for remediation details.
CISA's required action is to apply mitigations according to the vendor's instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." If no mitigations are available, organizations should follow BOD 26-04 guidance for cloud services or stop using the product. Stakeholders are responsible for checking each asset's internet exposure. The KEV entry lists forensic triage as "No."
Federal remediation due date: 2026-11-11.