PatchTheCVECVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability
CVE-2026-41709 is a low-severity flaw (CVSS 2.7) affecting esxi, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Why this priority
- Exploited in the wild (CISA KEV)
- Covered by 6 security sources
A fixed release or distro patch exists.
Risk facts
| CVSS score | 2.7 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 45%) |
| CISA exploited list | Yes, fix due 2026-11-11 |
| Weakness | CWE-778 |
| Published | 2026-07-30 |
| Last modified | 2026-10-29 |
Last updated 2026-10-29 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Updated Record last modified
- Deadline CISA due date for US federal agencies to patch
Advisories and coverage
Official advisories
- CISA Alerts and Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog 2026-10-28
- Canadian Cyber Centre: VMware security advisory (AV26-763) – Update 2 2026-10-28
- Google Cloud Security Bulletins: GCP-2026-050 2026-10-28
Research and news
- The Hacker News: China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility 2026-10-29
- Help Net Security: Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls 2026-10-29
- SecurityWeek Vulnerabilities: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day 2026-10-29
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-41709?
esxi: upgrade to 9.0.2.0100. Exact commands for each OS are on this page.
Is CVE-2026-41709 being exploited?
Yes. CVE-2026-41709 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2026-41709 affect?
CVE-2026-41709 affects esxi. Severity is low (CVSS 2.7). VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
How urgent is CVE-2026-41709?
Priority 51/100. Exploited in the wild (CISA KEV); Covered by 6 security sources
Software pages
Related CVEs
- CVE-2025-22225 HIGH 8.2 EXPLOITED MITIGATE MITIGATE VMware ESXi Arbitrary Write Vulnerability
- CVE-2025-22226 HIGH 7.1 EXPLOITED MITIGATE MITIGATE VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
- CVE-2025-22224 CRITICAL 9.3 EXPLOITED MITIGATE MITIGATE VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
- CVE-2024-37086 MEDIUM 6.8 UPGRADE MITIGATE VMware ESXi contains an out-of-bounds read vulnerability. A malicious actor with local administrative privile
- CVE-2024-37085 MEDIUM 6.8 EXPLOITED UPGRADE MITIGATE VMware ESXi Authentication Bypass Vulnerability