The Cybersecurity and Infrastructure Security Agency has added a VMware ESX logging flaw to its Known Exploited Vulnerabilities catalog following evidence of exploitation.
Tracked as CVE-2026-41709, the vulnerability allows an attacker with administrator access to perform certain operations without those actions being recorded in system logs
CISA added the flaw on October 28, 2026, and set November 11, 2026, as the remediation deadline. The warning raises the priority of a weakness that Broadcom rates as low severity, showing why a vulnerability’s score alone should not determine patching decisions.
VMWare ESX Logging Vulnerability Exploited
According to the official CVE record, the issue falls under CWE-778, or insufficient logging. Broadcom assigned it a CVSS v3.1 score of 2.7. Exploitation requires high privileges, and the published description identifies a malicious administrator as the attacker.
This is not described as a way for an unauthenticated attacker to gain initial access. Instead, someone with administrator rights can perform certain actions without leaving the expected log records.
That gap can make it harder for defenders to reconstruct activity during an investigation. Broadcom has not publicly listed the specific operations affected.
The flaw appeared in the same advisory covered in Cybersecurity News’ report on critical VMware vulnerabilities and authentication bypass CVE-2026-41709. However, the logging issue is separate from the more severe authentication bypass and code execution flaws included in that release.
Broadcom’s security advisory lists fixed ESX builds as ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 for the corresponding release branches.
VMware Cloud Foundation 5.x customers should update to version 5.2.4 using the vendor’s patching guidance. Affected deployments also include ESX components within VMware Cloud Foundation and vSphere Foundation. For VMware Telco Cloud Platform 5.0.x and 5.1. x,x, Broadcom directs customers to KB449886.
Administrators should match their installed product and release to the advisory’s response matrix before applying updates. Broadcom lists no workaround and credits CrowdStrike researcher Ian Barton with reporting the weakness.
CISA’s supplied entry marks ransomware use as unknown and says forensic triage is not required under BOD 26-04 for this entry. It directs organizations to follow vendor mitigations, assess internet exposure, and discontinue affected products if mitigations are unavailable.
Previous reporting on VMware vulnerabilities exploited in ransomware attacks concerns different CVEs and should not be treated as evidence linking this flaw to ransomware.
The immediate task is to identify affected ESX installations and apply the correct fixes. The low severity rating does not remove the need for action when exploitation has been reported.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
