VMware ESX Logging Flaw CVE-2026-41709: Patch Now

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41709, an insufficient-logging vulnerability in Broadcom VMware ESX, to its Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026. The flaw lets an attacker who already has administrator access to an ESX host perform certain operations without them showing up in the logs — in effect, a way to cover tracks after a host has already been compromised. Broadcom disclosed it back in July as part of a broader advisory covering five VMware vulnerabilities, rated it Low severity on its own, and shipped a fix. CISA's KEV listing means federal civilian agencies now have a hard deadline to apply it: November 11, 2026.

What happened

Broadcom published VMSA-2026-0006 on July 29, 2026, disclosing five vulnerabilities across VMware ESX, vCenter Server, Workstation and Fusion. Two were authentication-bypass and directory-traversal bugs in vCenter Server rated Critical (CVSS 9.8), one was an out-of-bounds write in ESX's VMXNET3 virtual network adapter rated Critical (CVSS 9.3), one was an out-of-bounds read affecting ESX, Workstation and Fusion rated Important to Low depending on the product, and the fifth — CVE-2026-41709 — was the insufficient-logging issue in ESX, the mildest of the batch at CVSS 2.7. Broadcom updated the advisory twice since, most recently on August 19, 2026, to add patch guidance for older ESX and vCenter 7.0 branches under extended support.

Three months later, it's the Low-severity logging bug — not the Critical remote-code-execution issues in the same advisory — that CISA has flagged as actively exploited and added to the KEV catalog. CISA's vulnerability-response data marks the exploitation status for CVE-2026-41709 as active. The agency's KEV catalog does not report a confirmed ransomware-campaign link for this entry, and it does not require the forensic-triage step it asks for on some other KEV additions, but its presence on the list at all means CISA has independent evidence of real-world use, not just a theoretical risk.

The other four bugs in the same advisory

VMSA-2026-0006 is worth reading in full context, because CVE-2026-41709 is the mildest item on a list that otherwise reads as urgent on its own terms. Here's how Broadcom rated the full set:

None of the other four currently appear on CISA's KEV catalog. That's a useful reminder of what the KEV list actually tracks: it is not a ranking of which bugs are most dangerous on paper, it's a record of which ones CISA has evidence are being used right now. A Critical authentication-bypass bug that nobody has weaponized yet, as far as CISA knows, doesn't make the list; a Low-severity logging gap that attackers are demonstrably using does. If your organization has been prioritizing patch cycles purely by CVSS score, this advisory is a case study in why that approach misses signal that KEV membership captures directly.

Why an ESX hypervisor bug is a bigger deal than the score suggests

VMware ESX is the hypervisor layer underneath most VMware Cloud Foundation, vSphere, and Telco Cloud Platform deployments, which makes it one of the most consolidated pieces of infrastructure in a typical enterprise data center: a single ESX host can run dozens of virtual machines spanning multiple business units, and a compromised hypervisor potentially puts every one of those workloads at risk simultaneously. That concentration of blast radius is exactly why ransomware operators and other intrusion actors have spent the past several years specifically targeting ESXi and vCenter — not to encrypt the hypervisor itself in most cases, but to reach the datastore layer and encrypt virtual disk files directly, taking down entire virtual machine fleets in one operation. A logging gap that lets a privileged attacker operate on that same hypervisor layer without leaving a clean audit trail fits squarely into that threat model, even though CVE-2026-41709 by itself doesn't grant access — it only hides what happens after access is obtained.

What CVE-2026-41709 actually is

Broadcom's advisory describes it plainly: "VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged." The CVSS vector — AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N — spells out the mechanics: it's reachable over the network, requires no user interaction, but needs high privileges (PR:H) to trigger, and its impact is limited to integrity (specifically, the integrity of the audit trail), not confidentiality or availability. In plain terms, this isn't a way to break into an ESX host. It's a way to act inside one, once you're already an administrator, without the normal audit log catching what you did.

That distinction matters for how you should think about the threat. A vulnerability that requires attacker-held admin rights before it does anything isn't a front door. It's closer to a blind spot in the security camera system for people who are already inside the building. That's exactly why it tends to surface in incident response rather than in a scan for internet-facing exposure: an attacker who has already escalated to ESX admin — through stolen credentials, a chained exploit, or any other route — can use this gap to operate with reduced visibility for defenders trying to reconstruct what happened.

Why CISA flagged the quiet bug instead of the loud ones

It's a reasonable question: why did CISA's KEV catalog pick up the Low-severity logging gap and not the two Critical vCenter bugs or the Critical VMXNET3 flaw from the same advisory? KEV listings track confirmed active exploitation, not raw severity — a CVSS 9.8 bug that nobody is currently using in the wild doesn't qualify, while a CVSS 2.7 bug that attackers are demonstrably using does. For defenders, the practical read is that this vulnerability is turning up in post-compromise activity on ESX hosts where an attacker already has the keys, which is consistent with how ESX and vCenter environments have been targeted broadly this year: initial access and privilege escalation first, then steps to operate undetected. A logging gap that lets a privileged attacker move without leaving a trail is a useful tool at exactly that stage.

Who's affected

The vulnerability affects VMware ESX directly, and by extension the Broadcom product lines that bundle it: VMware Cloud Foundation, vSphere Foundation, and VMware Telco Cloud Platform. Broadcom's response matrix lists the following ESX branches as affected, each with its own fixed build:

Broadcom's advisory notes that ESX 7.0 — which is on extended support — requires a separate support contract to obtain a patch; it is not covered by the standard fixed builds above. VMware Workstation and Fusion are not listed as affected by this particular CVE (they appear elsewhere in VMSA-2026-0006 for a different issue in the same advisory). As with any VMware Cloud Foundation or vSphere Foundation deployment, the practical takeaway is to patch the underlying ESX layer, not just the management plane.

How to fix it

There is no workaround. Broadcom's advisory lists "Workarounds: None" for CVE-2026-41709, which means upgrading to one of the fixed builds above is the only remediation path. For most environments that means scheduling a standard ESXi patch cycle to the build matching your branch; for VMware Cloud Foundation deployments, Broadcom routes patching through its async patch process (documented in KB88287) rather than a direct ESXi build install. Because this bug requires existing admin access to exploit, patching it doesn't close an open door by itself — it closes a gap that matters most after you've already confirmed, or ruled out, a broader compromise. Organizations that suspect an ESX host may have been accessed by an unauthorized administrator should treat audit-log gaps from before the patch was applied as a known limitation when reconstructing a timeline.

The CISA deadline and what it means for you

CISA's KEV catalog entry sets a remediation due date of November 11, 2026 for U.S. federal civilian agencies, under Binding Operational Directive 26-04, which replaced the older BOD 22-01 model with a risk-based remediation timeline rather than a flat 15- or 30-day rule. Under BOD 26-04, the clock starts the moment CISA adds a CVE to the KEV catalog (or when an agency identifies the vulnerability on an asset first, if that happens sooner), and the required action is to apply Broadcom's fix — or, if that's not possible, to follow BOD 26-04's cloud-service guidance or stop using the affected product. CISA's entry for CVE-2026-41709 does not require the forensic-triage step it mandates for some higher-risk KEV additions, and it lists ransomware use as "Unknown" rather than confirmed. Private-sector organizations aren't bound by the federal deadline, but running ESX, vCenter, or VMware Cloud Foundation at scale without a path to the November 11 date is a reasonable thing for any security team to flag internally.

Is it being exploited against you specifically?

CISA's KEV catalog confirms exploitation is active, but Broadcom's advisory does not publish indicators of compromise, attacker tooling, or details about who is using this flaw and how — that's typical for a KEV listing tied to a logging gap rather than an initial-access bug, since the kind of evidence that would show up is in logs that, by definition, this vulnerability can be used to avoid generating. If you operate ESX hosts and have independent evidence of unauthorized administrator access — unexplained configuration changes, unfamiliar admin accounts, or gaps in operational logs that don't match your own change records — treat that as the signal to investigate, rather than waiting for Broadcom or CISA to publish more specifics. This is a good moment to revisit basics on how vulnerabilities like this get discovered and tracked in the first place; our explainer on how zero-day vulnerabilities work covers the discovery-to-disclosure pipeline that advisories like VMSA-2026-0006 follow.

What to do next

If you run VMware ESX, vCenter, VMware Cloud Foundation, vSphere Foundation, or VMware Telco Cloud Platform, check your build number against Broadcom's response matrix above and schedule the upgrade to your branch's fixed build — there's no interim mitigation to fall back on. Federal agencies are working against the November 11, 2026 KEV deadline; everyone else should treat that same date as a sensible internal target, especially for any ESX host with broad administrative access or hypervisor-level privileges assigned to more than a small group. Because this specific bug is about audit-trail integrity rather than remote access, it's also worth reviewing who currently holds host-admin rights on your ESX estate — the vulnerability only matters to someone who already has them. For background on how CVSS scores like this one's 2.7 rating are calculated and why a "Low" score can still land on a federal patch-now list, see our guide on how CVE IDs and CVSS scores work.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage