CyberStack 
https://cyberstack.org/n/vmware-esx-insufficient-logging-41709-cisa-kev-20261028
Vulnerability
Published 2026-10-28 New
Verified 2026-10-29

VMware ESX CVE-2026-41709 (Broadcom: Low, CVSS 2.7) insufficient logging lets a malicious admin act without being logged — In CISA KEV since 28 Oct

CISA added CVE-2026-41709, a Broadcom VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October 2026 based on evidence of active exploitation; the KEV entry gives US federal agencies a due date of 11 November and lists known ransomware campaign use as 'Unknown'.

Broadcom's advisory VMSA-2026-0006 (issued 29 July 2026, updated 19 August) says VMware ESX contains an insufficient logging vulnerability that a malicious administrator could exploit to perform certain operations without them being logged; Broadcom rates it Low severity with a maximum CVSSv3 base score of 2.7 and credits Ian Barton of CrowdStrike for reporting it. Broadcom lists no workaround.

The same advisory also covers the critical vCenter flaws CVE-2026-59309 and CVE-2026-59310 (see the CVE-2026-59310 card). CISA's alert does not say who exploited the flaw or how.

Product
Broadcom VMware ESX (also in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform)
Versions
Fixed (Broadcom VMSA-2026-0006 response matrix, as of 29 Oct): ESX 9.1.x.x → ESXi-9.1.0.0-25370933; ESX 9.0.x.x → ESXi-9.0.2.0100-25595025; ESX 8.0 → ESXi80U3j-25429389; VMware Cloud Foundation 5.x → 5.2.4 (Async Patching Guide KB88287); VMware Telco Cloud Platform 5.0.x, 5.1.x → KB449886.
CVSS
(Broadcom, CVSSv3; Low)
Exploited in Australia?
unknown
Patch to
Update ESX to the fixed builds in Broadcom's VMSA-2026-0006 response matrix (ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389; VCF 5.2.4); no workaround. Because the flaw lets an administrator act without being logged, restrict and review ESX administrator access.

vulnerabilities cloud