CVE-2026-41709 ESX insufficient logging vulnerability
LowCVSS 2.7
EPSS 0.69%
CISA KEV
added 2026-10-28 · due 2026-11-11
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
CISA Known Exploited Vulnerability
- Date added
- 2026-10-28
- Due date (FCEB)
- 2026-11-11
- Ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware Cloud Foundation | = 9.1.x.x | No fix listed |
| VMware Cloud Foundation | = 9.0.x.x | No fix listed |
| VMware Cloud Foundation | >= 5.x, < 5.2.4 | 5.2.4 |
| VMware vSphere Foundation | = 9.1.x.x | No fix listed |
| VMware vSphere Foundation | = 9.0.x.x | No fix listed |
| VMware ESX | >= 9.1.x.x, < ESXi-9.1.0.0-25370933 | ESXi-9.1.0.0-25370933 |
| VMware ESX | >= 9.0.x.x, < ESXi-9.0.2.0100-25595025 | ESXi-9.0.2.0100-25595025 |
| VMware ESX | >= 8.0, < ESXi80U3j-25429389 | ESXi80U3j-25429389 |
| VMware Telco Cloud Platform | = 5.1.x | No fix listed |
| VMware Telco Cloud Platform | = 5.0.x | No fix listed |
| VMware esxi | >= 9.0.0, < 9.0.2.0100 | 9.0.2.0100 |
| VMware esxi | = 8.0 | No fix listed |
| VMware esxi | = 8.0-a | No fix listed |
| VMware esxi | = 8.0-b | No fix listed |
| VMware esxi | = 8.0-c | No fix listed |
| VMware esxi | = 8.0-d | No fix listed |
| VMware esxi | = 8.0-e | No fix listed |
| VMware esxi | = 8.0-f | No fix listed |
| VMware esxi | = 8.0-g | No fix listed |
| VMware esxi | = 8.0-update_1 | No fix listed |
| VMware esxi | = 8.0-update_1a | No fix listed |
| VMware esxi | = 8.0-update_1c | No fix listed |
| VMware esxi | = 8.0-update_1d | No fix listed |
| VMware esxi | = 8.0-update_2 | No fix listed |
| VMware esxi | = 8.0-update_2b | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware esxi | = 8.0-update_2c | No fix listed |
| VMware esxi | = 8.0-update_2d | No fix listed |
| VMware esxi | = 8.0-update_2e | No fix listed |
| VMware esxi | = 8.0-update_2f | No fix listed |
| VMware esxi | = 8.0-update_3 | No fix listed |
| VMware esxi | = 8.0-update_3b | No fix listed |
| VMware esxi | = 8.0-update_3c | No fix listed |
| VMware esxi | = 8.0-update_3d | No fix listed |
| VMware esxi | = 8.0-update_3e | No fix listed |
| VMware esxi | = 8.0-update_3f | No fix listed |
| VMware esxi | = 8.0-update_3g | No fix listed |
| VMware esxi | = 8.0-update_3h | No fix listed |
| VMware esxi | = 8.0-update_3i | No fix listed |
References
- support.broadcom.com vendor-advisory
- www.cisa.gov government-resource us-government-resource