IT SBIT Services
Schneeberger
DEEN
CVE tracker

VMware ESX: Insufficient logging allows unlogged administrative operations

CVE-2026-41709Low 2.7Actively exploited

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 28 Oct 2026
Deadline for US federal agencies: 11 Nov 2026

Summary

VMware ESX (ESXi hypervisor) contains an insufficient logging flaw (CWE-778) that allows a malicious administrator to perform certain operations without them being logged. The attacker needs existing high-privilege administrator access on the host, so the flaw is not a standalone entry point but weakens detection after another compromise. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, and the flaw is part of VMSA-2026-0006, which also contains critical vCenter issues.

Affected

  • VMware ESX 8.0 before ESXi80U3j-25429389
  • VMware ESX 9.0.x before ESXi-9.0.2.0100-25595025
  • VMware ESX 9.1.x before ESXi-9.1.0.0-25370933
  • VMware Cloud Foundation 5.x before 5.2.4 (per CVE record)
  • ESX 7.x: Unknown. Verify against the Broadcom advisory.

Fixed in

  • ESXi80U3j-25429389 (8.0)
  • ESXi-9.0.2.0100-25595025 (9.0.x)
  • ESXi-9.1.0.0-25370933 (9.1.x)
  • Newer builds of the same branches

Workaround

Unknown. Broadcom lists no workaround; patching is the only vendor fix.

Exploitation

  • CISA lists the flaw as known exploited, added 28 October 2026, with a remediation deadline of 11 November 2026.
  • Secondary reporting says a China-nexus threat actor used it as a zero-day in intrusions against US organizations. Broadcom and CISA have not published details or indicators of compromise.
  • Public proof of concept: Unconfirmed.

Our recommendation

  • Inventory all ESXi hosts and vCenter instances and record their exact build numbers.
  • Patch ESX hosts to the fixed builds above, and patch vCenter per VMSA-2026-0006, prioritising CVE-2026-59309 if vCenter is reachable from untrusted networks.
  • Remove direct internet exposure of ESXi and vCenter management interfaces and restrict them to a dedicated admin network.
  • Review administrator logins and privilege changes for anything unusual, bearing in mind that unlogged operations may leave no trace.
  • Complete patching before the 11 November 2026 KEV deadline.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:51.

Original description (NVD)

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed