CISA lists exploited VMware ESX logging flaw CVE-2026-41709
Original title: CISA Warns of VMWare ESX Logging Vulnerability Exploited in Attacks
An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.
CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on October 28, 2026, after evidence of exploitation. A malicious administrator can perform certain VMware ESX operations without the expected log records, which can hinder investigations. Broadcom scores the CWE-778 flaw 2.7 and lists fixed ESX builds; it gives no workaround and does not name the affected operations. CISA marks ransomware use unknown and says this entry is separate from earlier VMware ransomware reports.
Unconfirmed: Broadcom has not named the unlogged operations, and CISA says ransomware use is unknown.
- CISA set a November 11, 2026 remediation deadline under the KEV entry.
- Fixed builds include ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389.
- VMware Cloud Foundation 5.x customers are directed to update to 5.2.4.
- Telco Cloud Platform 5.0.x and 5.1.x customers are pointed to KB449886.
- CrowdStrike researcher Ian Barton is credited with reporting the flaw.
Impact: Admin actions can omit expected ESX log records
| Product | Affected | Fixed in |
|---|---|---|
| Broadcom VMware ESXi | — | ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 |
| Broadcom VMware Cloud Foundation | 5.x | 5.2.4 |
| Broadcom VMware Telco Cloud Platform | 5.0.x and 5.1.x | — |
- 1.Match installed ESX products to Broadcom’s advisory and apply the listed fixed builds.
- 2.Update VMware Cloud Foundation 5.x to 5.2.4 using vendor guidance.
- 3.Follow CISA’s direction to apply vendor mitigations or discontinue products if none exist.
- CVEs
- CVE-2026-41709
- Vendors
- Broadcom
- Organizations
- CISACrowdStrike
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
The Cybersecurity and Infrastructure Security Agency has added a VMware ESX logging flaw to its Known Exploited Vulnerabilities catalog following evidence of exploitation. Tracked as CVE-2026-41709, the vulnerability allows an attacker with administrator access to perform certain operations without those actions being recorded in system logs CISA added the flaw on October 28, 2026, and […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.