On 28 October 2026 CISA added CVE-2026-41709, an insufficient logging vulnerability in VMware ESX, to its Known Exploited Vulnerabilities (KEV) catalogue. Broadcom described the flaw in security advisory VMSA-2026-0006, first published on 29 July 2026, and rates it Low (CVSS 2.7). Fixed ESX builds have been available since that date.
The severity rating is low, but CISA's listing means the flaw is being treated as exploited, so it is worth confirming your hosts are patched. CISA's catalogue description says the flaw could allow a malicious actor with admin access to perform certain operations without them being logged.
Who is affected
According to Broadcom's advisory and the NVD record, the following products are affected. ESX hosts below the listed build are vulnerable.
| Product | Affected versions | Fixed in |
|---|---|---|
| ESX 9.1.x | Earlier than ESXi-9.1.0.0-25370933 | ESXi-9.1.0.0-25370933 |
| ESX 9.0.x | Earlier than ESXi-9.0.2.0100-25595025 | ESXi-9.0.2.0100-25595025 |
| ESX 8.0 | Earlier than ESXi80U3j-25429389 | ESXi80U3j-25429389 |
| VMware Cloud Foundation 5.x | Earlier than 5.2.4 | 5.2.4 |
| Telco Cloud Platform 5.0.x and 5.1.x | Listed as affected | KB449886 |
Broadcom's advisory describes the issue as one where a malicious administrator could perform certain operations without them being logged. The NVD record's CVSS 3.1 vector lists high privileges required (PR:H).
The same advisory, VMSA-2026-0006, also covers other vulnerabilities in ESX, vCenter, Workstation and Fusion, some rated Critical. Review the whole advisory when planning updates, not only this CVE.
Is it being exploited?
CISA added CVE-2026-41709 to the KEV catalogue on 28 October 2026 with a remediation due date of 11 November 2026 for US federal agencies, and lists known ransomware campaign use as "Unknown". The version of the Broadcom advisory we reviewed does not itself say the flaw is exploited. Neither source names a threat actor or describes how the flaw is being used.
What to do now
- Update ESX to the fixed build for your version: ESXi-9.1.0.0-25370933 (9.1.x), ESXi-9.0.2.0100-25595025 (9.0.x) or ESXi80U3j-25429389 (8.0). For VMware Cloud Foundation 5.x, use 5.2.4. For Telco Cloud Platform, follow KB449886.
- Apply the update through your normal change process. Broadcom lists no workaround for this CVE, so patching is the remedy.
- Follow CISA's required action if you are subject to it: apply the vendor's mitigations in line with CISA's BOD 26-04 guidance and its Forensics Triage Requirements.
How to check whether you were affected
Neither Broadcom nor CISA publishes indicators of compromise for this flaw in the pages we reviewed. Because the issue concerns operations that may not be logged, the practical first step is to confirm which ESX build each host runs and compare it with the table above. CISA's entry refers to its Forensics Triage Requirements for further guidance.
How SmartSITT can help
SmartSITT offers cybersecurity services and a gap assessment to review your virtualisation estate and patch status. We provide 24/7 monitoring and support; that is a fact about our service, not a statement about this vulnerability.
Sources
- Broadcom security advisory VMSA-2026-0006 (published 29 July 2026, last updated 19 August 2026): Broadcom support portal
- NVD record: CVE-2026-41709
- CISA KEV entry, added 28 October 2026: CISA KEV catalogue