CVE-2026-41709: VMware ESXi Logging Flaw
Active exploitation confirmed in CISA KEV.
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-28. Federal agencies must patch by 2026-11-11.
TL;DR - CVE-2026-41709 is a VMware ESX/ESXi insufficient-logging flaw with a CVSS score of 2.7. - A malicious administrator may perform certain operations without those actions being recorded in expected logs. - CISA lists it in the Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. - Organizations should identify affected builds, investigate audit gaps, and patch by November 11, 2026.
CVE-2026-41709 affects VMware ESX/ESXi and related VMware platforms through insufficient logging. Although the vulnerability has a low CVSS score, its inclusion in CISA KEV makes it an urgent operational and incident-response issue for organizations running affected VMware environments.
What Is the Root Cause?
The root cause is insufficient auditing of certain administrator operations in VMware ESX. An operation may succeed while the expected corresponding event is absent from local or centralized logs. That breaks the link between an administrative action and the monitoring systems defenders rely on.
This differs from a vulnerability that directly grants access. The available description indicates that exploitation requires a malicious administrator. The flaw therefore compounds an existing compromise, stolen privileged credentials, insider threat, or unauthorized administrator session rather than serving as a clearly documented unauthenticated entry point.
The security impact includes:
- Evasion of administrator-activity monitoring
- Missing evidence of configuration changes
- Gaps in incident timelines
- Difficulty attributing actions to individual accounts
- Reduced confidence in SIEM and centralized audit records
- Delayed discovery of post-compromise activity
- Impaired forensic triage and response
Organizations should compare expected administrative workflows with observed logs. A missing event is not, by itself, proof of exploitation. Log collection failures, retention policies, time-synchronization problems, and forwarding errors can produce similar symptoms.
Unexplained gaps involving privileged activity should still be preserved and investigated, particularly on internet-exposed or broadly accessible management interfaces.
What Happened?
CVE-2026-41709 is an insufficient-logging vulnerability affecting VMware ESX/ESXi and related VMware platform products. A malicious administrator may perform certain operations without those operations being recorded in expected logs.
The primary consequence is reduced auditability and forensic visibility—not remote code execution or documented initial privilege escalation. However, missing audit records can make it harder to detect, investigate, and attribute post-compromise activity.
CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on October 28, 2026. The assigned remediation deadline is November 11, 2026.
The available research record reports a CVSS base score of 2.7 but does not provide the complete CVSS vector string. Verify current NVD and Broadcom records before using individual score components for risk modeling.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-41709 |
| Vendor/project | Broadcom / VMware |
| Affected product family | VMware ESX/ESXi and related VMware platforms |
| Vulnerability type | Insufficient logging |
| CVSS | 2.7 Low |
| Attack vector | Not fully disclosed in the available record; administrative access is required |
| Authentication / privileges | A malicious administrator is required |
| Patch available | Yes |
| Known exploitation | Confirmed by CISA KEV listing |
| Public PoC | No verified public exploit repository identified in the available primary-source material |
| CISA date added | 2026-10-28 |
| CISA remediation due date | 2026-11-11 |
| Ransomware association | Unknown |
A low base score does not make this issue operationally harmless. An attacker with administrator-level access could use missing audit records to hide configuration changes, destructive actions, persistence-related activity, or other post-compromise operations.
For related security planning, review this web application hardening checklist and ensure that privileged management interfaces receive equivalent protection.
Analyst’s Take: Patch priority should be driven by confirmed KEV exploitation and the November 11, 2026 deadline—not by the 2.7 CVSS score alone. The flaw requires administrator access, but that is precisely why affected management systems and privileged-account activity should be reviewed alongside the upgrade.
Who Needs to Act?
Administrators should inventory all ESXi hosts and VMware platform deployments, then map each asset to the applicable fixed build. The currently identified affected branches and remediations are:
| Product or platform | Affected versions | Fixed version or required remediation |
|---|---|---|
| VMware ESX/ESXi 9.1 | 9.1.x.x before the fixed build | ESXi-9.1.0.0-25370933 |
| VMware ESX/ESXi 9.0 | 9.0.x.x before the fixed build | ESXi-9.0.2.0100-25595025 |
| VMware ESX/ESXi 8.0 | 8.0 before the fixed build | ESXi80U3j-25429389 |
| VMware Cloud Foundation | 5.x before 5.2.4 | Upgrade to 5.2.4 |
| VMware Cloud Foundation | 9.0.x.x and 9.1.x.x | Apply the corresponding fixed ESXi build |
| VMware vSphere Foundation | 9.0.x.x and 9.1.x.x | Apply the corresponding fixed ESXi build |
| VMware Telco Cloud Platform | 5.0.x and 5.1.x | Follow Broadcom KB449886 |
Treat these as currently identified remediation points, not as a substitute for the authoritative Broadcom product matrix. Later cumulative builds may supersede the exact fixed builds shown above.
Organizations with unsupported, customized, or partially upgraded environments should consult Broadcom’s advisory before selecting a package.
Prioritize hosts and management components with:
- Administrator accounts reachable from less-trusted networks
- Internet-exposed management interfaces
- Shared credentials
- Weak privileged-access controls
- Broad administrative permissions
- Evidence of unexplained configuration or operational changes
Cloud Foundation, vSphere Foundation, and Telco Cloud Platform operators should not assume that updating a single ESXi host completes platform-level remediation. Validate the full deployment against Broadcom’s guidance and confirm that all relevant underlying ESXi instances are on fixed builds.
Why Is the CVSS Score Low?
The reported CVSS base score is 2.7, classified as Low. That rating is consistent with a vulnerability whose primary impact is loss of logging and audit visibility rather than direct confidentiality, integrity, or availability compromise.
The available record does not include the complete CVSS vector, so the precise values for attack vector, attack complexity, privileges required, user interaction, scope, and impact metrics should not be reconstructed or guessed.
The exploit prerequisite is significant: the available vulnerability description says that a malicious administrator must already have the ability to perform the relevant operations. That requirement reduces the likelihood that the issue can be used as a standalone remote attack against an unprivileged or unauthenticated target.
It does not eliminate risk where administrator credentials are:
- Exposed
- Reused
- Phished
- Shared
- Accessible through compromised management workstations
- Not protected by strong privileged-access controls
CVSS also does not fully capture operational detection risk. A vulnerability that weakens audit trails can make a separate intrusion harder to identify and investigate.
CISA KEV inclusion is therefore a stronger prioritization signal for this issue than the numerical base score alone. Treat KEV status, asset exposure, privileged-account risk, and evidence of unexplained logging gaps as part of the local risk decision.
Has CVE-2026-41709 Been Exploited?
Yes. CISA has added CVE-2026-41709 to the Known Exploited Vulnerabilities catalog, confirming exploitation in real-world conditions.
CISA added the vulnerability on October 28, 2026, and assigned a remediation deadline of November 11, 2026.
CISA identifies the ransomware-campaign association as unknown. That does not mean ransomware use has been ruled out; it means the available CISA catalog entry does not establish that connection.
Organizations should preserve relevant logs and forensic evidence before making changes if they suspect the vulnerability was used in an intrusion.
No verified public exploit repository, proof-of-concept, or detailed public exploit code was identified in the available primary-source material. The absence of a public PoC is not a reason to defer remediation. The KEV listing is evidence of active exploitation even when the exploit mechanism is not publicly documented.
Technical Notes
The expected exploitation effect is not necessarily a distinctive crash or network request. Investigators should look for privileged operations that lack corresponding audit records, particularly where management-plane access, account activity, and configuration state indicate that an action occurred.
Correlate these sources where available:
- ESXi host logs
- vCenter and platform-management audit logs
- Authentication and privileged-access-management records
- VPN, bastion, firewall, and management-network telemetry
- Configuration backups and change-management records
- SIEM ingestion and parser-health telemetry
A useful starting query for environments that normalize VMware administrative events is:
vendor="VMware"
(event.category="authentication" OR event.category="configuration" OR event.category="admin")
(user.privileged=true)
| stats count as logged_events,
min(@timestamp) as first_seen,
max(@timestamp) as last_seen
by user.name, host.name, source.ip
| where logged_events = 0
This query is a correlation pattern rather than universal VMware syntax. Adapt field names to the organization’s SIEM and compare activity with identity-provider, bastion, and network records. A zero-event result is an investigation lead, not proof of exploitation.
Detection Guidance
Start with exposure identification. Enumerate ESXi versions and builds from vCenter, host-management tooling, asset databases, and configuration-management systems.
Include standalone ESXi hosts and platform-managed instances that may not appear in the same inventory. Compare each build with the fixed versions supplied by Broadcom.
Then investigate the integrity and completeness of administrative logging. Look for privileged logins followed by configuration or operational changes that are visible in state comparisons but absent from expected audit trails.
Inspect:
- Log-forwarding health
- Retention settings
- Time synchronization
- SIEM parser failures
- Collector outages
- Configuration snapshots
- Change-management records
These checks help distinguish exploitation from ordinary telemetry problems.
Technical Notes
A basic ESXi build-inventory check can be performed locally on a host:
vmware -vl
esxcli system version get
For centrally managed environments, obtain equivalent version and build data through the organization’s vCenter or VMware management tooling.
Do not assume that a host reporting a major version is fixed. Compare the complete build identifier with the applicable Broadcom remediation.
For log review, search for privileged authentication and administrative activity around unexplained configuration changes. A generic SIEM pattern is:
(host.product="VMware ESXi" OR vendor="VMware")
| transaction host.name user.name maxspan=30m
| where action IN ("login", "configuration_change", "service_change",
"network_change", "permission_change")
| stats values(action) as actions,
values(source.ip) as source_ips,
count by host.name, user.name, bin(_time, 30m)
| where mvcount(actions) < 2
The exact event names vary by VMware version, collector, and SIEM integration. Validate the query against known-good administrative changes and create alerts for:
- Administrator logins from new source addresses
- Privileged activity outside approved maintenance windows
- Changes present in configuration snapshots but absent from audit logs
- Sudden gaps in ESXi-to-SIEM forwarding
- Administrative actions from hosts or accounts not associated with the change ticket
Preserve raw logs and relevant network telemetry before rotating credentials or rebuilding systems when compromise is suspected. Log gaps are potentially important evidence, but they must be interpreted alongside collector health and retention data.
Remediation and Patching
Apply the vendor-provided fixed build for every affected ESXi branch. The currently identified targets are:
- ESXi 9.1:
ESXi-9.1.0.0-25370933 - ESXi 9.0:
ESXi-9.0.2.0100-25595025 - ESXi 8.0:
ESXi80U3j-25429389 - VMware Cloud Foundation 5.x: upgrade to
5.2.4where applicable - VMware Telco Cloud Platform 5.0.x and 5.1.x: follow Broadcom KB449886
Use the organization’s supported lifecycle-management process, including vSphere Lifecycle Manager, vendor-approved image management, or the applicable offline bundle procedure.
Before deployment, confirm:
- Hardware compatibility
- Maintenance-mode requirements
- Cluster capacity
- Workload mobility
- Rollback planning
- Backup and recovery readiness
After updating, verify the actual host build and test that representative administrative operations generate the expected audit records and reach centralized logging.
Technical Notes
The exact upgrade command depends on the image, depot, and lifecycle-management workflow. For a standalone ESXi host using an approved offline depot, the generic ESXCLI pattern is:
esxcli software profile update \
-d /vmfs/volumes/<datastore>/<approved-esxi-depot>.zip \
-p <approved-esxi-image-profile>
Use the exact depot and image profile supplied through Broadcom’s supported update path. Do not substitute an unverified profile name or package.
Reboot only according to the organization’s maintenance procedure, then verify:
esxcli system version get
vmware -vl
For managed clusters, prefer the approved vSphere Lifecycle Manager image or baseline workflow and validate every host after remediation.
Cloud Foundation and vSphere Foundation operators should use the platform’s supported upgrade process rather than treating the underlying ESXi package as an isolated standalone update.
If immediate patching is impossible, apply layered mitigations while scheduling the upgrade:
- Remove direct internet exposure from ESXi and management interfaces.
- Restrict administrative access to dedicated management networks, bastions, or VPNs.
- Enforce MFA through the organization’s supported privileged-access architecture.
- Remove unnecessary administrator accounts and prohibit shared credentials.
- Review and rotate credentials if compromise is suspected.
- Increase retention and centralization of available host, vCenter, identity, and network logs.
- Monitor for administrative activity inconsistent with change records.
- Follow Broadcom’s advisory and CISA guidance; do not treat network restriction as a permanent substitute for the vendor fix.
Organizations securing administrative access should also review the distinction between MFA and 2FA when designing privileged-access controls.
CISA’s KEV remediation deadline is November 11, 2026. Organizations unable to patch by that date should document the exception, restrict exposure as far as practical, preserve evidence, and maintain an explicit remediation owner and deadline.
References
-
NVD: CVE-2026-41709
Provides the CVE record, vulnerability description, and reported CVSS information. -
Broadcom security advisory and remediation information
Authoritative source for affected products, fixed builds, supported-branch guidance, and update instructions. -
CISA Known Exploited Vulnerabilities catalog
Confirms KEV inclusion, the October 28, 2026 addition date, and the November 11, 2026 remediation deadline. -
Broadcom KB449886
Required remediation reference for VMware Telco Cloud Platform 5.0.x and 5.1.x deployments. Consult Broadcom Support for the current article and platform-specific instructions.
CVE-2026-41709 is not primarily an initial-access vulnerability, but it can allow a malicious administrator to operate without reliable audit evidence. Because CISA confirms exploitation in the wild, organizations should identify affected VMware deployments, apply the appropriate fixed build, preserve and review administrative telemetry, and restrict management-plane access.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.