CISA KEV: VMware ESX logging flaw CVE-2026-41709 exploited
Original title: CISA KEV: Broadcom VMWare ESX Insufficient Logging Vulnerability — Broadcom VMware ESX (CVE-2026-41709)
An attacker who already has admin access can perform certain ESX operations without them being logged; due November 11.
CISA added Broadcom VMware ESX CVE-2026-41709 to the Known Exploited Vulnerabilities catalog. The insufficient logging flaw could let a malicious actor with admin access perform certain operations without being logged. Agencies must apply vendor mitigations under BOD 26-04 and CISA forensics triage guidance, with a due date of 2026-11-11. Known ransomware campaign use is listed as unknown.
Unconfirmed: CISA lists known ransomware campaign use as unknown and does not name affected versions.
- Exploitation requires existing admin access.
- The federal remediation due date is 2026-11-11.
- Cloud services must follow applicable BOD 26-04 guidance.
- Stakeholders must judge each asset's internet exposure.
Impact: Admin can perform certain ESX operations without logs
| Product | Affected |
|---|---|
| Broadcom VMware ESX | — |
- 1.Apply vendor mitigations by 2026-11-11 under BOD 26-04.
- 2.Follow CISA forensics triage requirements for exposed assets.
- 3.Discontinue use if mitigations are unavailable.
- CVEs
- CVE-2026-41709
- Vendors
- Broadcom
- Products
- VMware ESX
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
From the original article
1 min read at cisa.govBroadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.