VMware ESX insufficient logging flaw (CVE-2026-41709). CVSS 2.7 but listed in CISA KEV. Fixed builds and what to do now.
One of the things server admins dread most is an action that happens without leaving any record. Broadcom’s VMware ESX flaw makes exactly that possible. The score looks low, but CISA has added it to its catalog of vulnerabilities exploited in the wild. So it deserves attention, not a shrug.
Short answer: CVE-2026-41709 is an insufficient logging flaw in VMware ESX. A malicious administrator can perform certain operations without them being logged. The CVSS score is 2.7 (low), but CISA added the flaw to its KEV catalog on October 28, 2026. Check your ESX build and update to a fixed version listed in Broadcom’s VMSA-2026-0006 advisory. If you cannot update right away, narrow administrator access and ship logs off the host.
What happened?
ESX is the hypervisor that runs your virtual machines. The flaw comes from ESX not recording some operations as it should. In security terms this is CWE-778, “Insufficient Logging”. The system does the work, but it does not keep a full trail of every step.
Exploitation requires administrator privileges, which is why the CVSS score is low. Still, someone who already holds that access can use the gap to hide certain actions from the logs.
Broadcom published the flaw on July 29, 2026 as VMSA-2026-0006, crediting Ian Barton of CrowdStrike. CISA added it to the KEV catalog on October 28, 2026. The due date CISA set for federal agencies is November 11, 2026.
The flaw is a few months old. The NVD record is dated July 30, 2026. So it is not new, but its use in attacks was confirmed recently. The KEV entry lists known ransomware use as “Unknown”.
Who is affected?
| Item | Details |
|---|---|
| CVE ID | CVE-2026-41709 |
| CVSS | 2.7, severity Low (vector: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) |
| Weakness type | CWE-778, Insufficient Logging |
| NVD published | July 30, 2026 |
| Vendor advisory | VMSA-2026-0006, July 29, 2026 (updated August 19, 2026) |
| Added to CISA KEV | October 28, 2026 |
| CISA due date | November 11, 2026 |
| Ransomware use | Unknown |
| Fixed: VCF / vSphere Foundation 9.1.x (ESX) | ESXi-9.1.0.0-25370933 |
| Fixed: VCF / vSphere Foundation 9.0.x (ESX) | ESXi-9.0.2.0100-25595025 |
| Fixed: vSphere ESXi 8.0 | ESXi80U3j-25429389 |
| Fixed: VCF 5.x | 5.2.4 |
| Fixed: Telco Cloud Platform 5.0.x and 5.1.x | See KB449886 in the advisory |
| Not in the vendor matrix | ESX 7.0, Workstation, Fusion |
If your version is not in the table, open the VMSA-2026-0006 advisory and check the row for your product line. The matrix does not list ESX 7.0 or the desktop products for this CVE. Still, confirm that yourself on the advisory page before you rely on it.
What should you do?
- Find your version. SSH into the ESX host and run
esxcli system version get. Check the Version and Build lines. The vSphere client shows the same information on the host summary page. - Compare the build number. Match the build you see with the fixed build in the table above. If your build is older than the fixed one, the host needs the update.
- Update. Apply the patch with vSphere Lifecycle Manager or Update Manager. Try it on a test host first, then roll it out to production in maintenance mode.
- Narrow administrator access. The flaw requires administrator rights. Remove shared admin accounts, make sure each admin signs in with a personal account, and take back permissions nobody needs.
- Ship logs off the host. Configure a syslog server. This does not close the flaw itself. But if logs on the host are lost or altered, a copy still exists elsewhere.
- If you cannot patch right away. The advisory lists no workaround for this CVE. CISA’s guidance is to stop using the product if mitigations are unavailable. In practice, schedule the patch window this week and review administrator logins from your external log copy by hand until then.
- If something looks wrong. Review recent admin logins and unexpected changes on the host. If you find a gap or an action you cannot explain, notify your incident response contact right away.
Frequently asked questions
Does this affect me?
Yes, if you run VMware ESX (ESXi) and you are not on a fixed build. The vendor matrix does not list Workstation or Fusion for this CVE, so desktop virtualization may have a different priority.
The CVSS score is low. Does it still matter?
Yes. The score is low, but CISA lists the flaw as actively exploited. CVSS is not a full measure of risk. This flaw makes it harder to see what an attacker did, which slows down incident investigation.
What if I cannot update right away?
The advisory lists no workaround. Reduce the number of admin accounts, ship logs off the host, and plan the patch as soon as possible. Federal agencies have until November 11, 2026, so use that date as a guide for your own priority.
Sources
- NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-41709
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Broadcom security advisory VMSA-2026-0006: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
This article was prepared on November 6, 2026 based on CISA and NVD records. It will be updated if new information is published. For server updates and security maintenance, you can reach me through the quote form.