CISA adds exploited VMware ESXi logging flaw CVE-2026-41709 to KEV
Original title: CISA Adds Actively Exploited VMware ESXi Logging Flaw to KEV Catalog
Federal remediation is due November 11, 2026; the CVSS 2.7 flaw only hides actions by someone who already has admin rights.
CISA added CVE-2026-41709, an insufficient-logging flaw in Broadcom VMware ESX, to the Known Exploited Vulnerabilities catalog on October 28, 2026, after evidence of exploitation in the wild. An administrator can perform certain operations without them being logged. CISA set a November 11, 2026 deadline and said ransomware use is unknown and forensic triage is not required under BOD 26-04.
Unconfirmed: CISA says whether the flaw is used in ransomware campaigns is unknown.
- CVSS v3.1 is 2.7 and the weakness is CWE-778, Insufficient Logging.
- Fixed builds listed are ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, and ESXi-9.1.0.0-25370933.
- Affected listings also include VMware Cloud Foundation, vSphere Foundation, and Telco Cloud Platform.
- The flaw does not itself grant initial access or administrator privileges.
Impact: Admins can perform operations without those actions being logged
| Product | Affected | Fixed in |
|---|---|---|
| Broadcom VMware ESXi | ESX 8.0, 9.0, and 9.1 branches | ESXi80U3j-25429389; ESXi-9.0.2.0100-25595025; ESXi-9.1.0.0-25370933 |
| Broadcom VMware Cloud Foundation | — | — |
| Broadcom vSphere Foundation | — | — |
| Broadcom Telco Cloud Platform | — | — |
- 1.Apply Broadcom mitigations and match deployed builds to the listed fixed thresholds.
- 2.Meet the November 11, 2026 KEV remediation deadline under BOD 26-04.
- 3.Discontinue affected products if vendor mitigations are unavailable.
- CVEs
- CVE-2026-41709
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
From the original article
2 min read at gbhackers.com
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41709, a vulnerability related to insufficient logging affecting Broadcom VMware ESX, to its Known Exploited Vulnerabilities (KEV) catalog. This decision was made after evidence of exploitation in the wild was discovered. The announcement, made on October 28, 2026, raised the priority of addressing this flaw, despite its […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.