{"cvss":2.7,"datePublished":"2026-07-30T14:16:57.420","dateUpdated":"2026-10-29T17:29:11.590","description":"VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.","id":"CVE-2026-41709","raw":{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Cloud Foundation","vendor":"VMware","versions":[{"status":"affected","version":"9.1.x.x"},{"status":"affected","version":"9.0.x.x"},{"lessThan":"5.2.4","status":"affected","version":"5.x","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"vSphere Foundation","vendor":"VMware","versions":[{"status":"affected","version":"9.1.x.x"},{"status":"affected","version":"9.0.x.x"}]},{"defaultStatus":"unaffected","product":"ESX","vendor":"VMware","versions":[{"lessThan":"ESXi-9.1.0.0-25370933","status":"affected","version":"9.1.x.x","versionType":"custom"},{"lessThan":"ESXi-9.0.2.0100-25595025","status":"affected","version":"9.0.x.x","versionType":"custom"},{"lessThan":"ESXi80U3j-25429389","status":"affected","version":"8.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Telco Cloud Platform","vendor":"VMware","versions":[{"status":"affected","version":"5.1.x"},{"status":"affected","version":"5.0.x"}]}],"source":"security@vmware.com"}],"cisaActionDue":"2026-11-11","cisaExploitAdd":"2026-10-28","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Broadcom VMWare ESX Insufficient Logging Vulnerability","configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*","matchCriteriaId":"D7DC2815-CD13-42DC-96E5-412CFB768A6A","versionEndExcluding":"9.0.2.0100","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*","matchCriteriaId":"7A1A402A-9262-4B97-A0B7-E5AE045E394D","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*","matchCriteriaId":"FE44B379-9943-4DD1-8514-26F87482AFA8","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*","matchCriteriaId":"2A797377-8945-4D75-AA68-A768855E5842","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*","matchCriteriaId":"79D84D76-54BE-49E9-905C-7D65B4B42D68","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:d:*:*:*:*:*:*","matchCriteriaId":"E3BC5C77-258A-4920-B217-396212056B14","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:e:*:*:*:*:*:*","matchCriteriaId":"17D484EB-037C-46E2-ADDF-846B3A02843F","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:f:*:*:*:*:*:*","matchCriteriaId":"9E689385-7521-4A7A-B81E-DD84A3B58238","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:g:*:*:*:*:*:*","matchCriteriaId":"69E59579-57D6-40BA-98FA-28D3C41BA222","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*","matchCriteriaId":"2F8767F7-7C3D-457D-9EAC-E8A30796F751","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*","matchCriteriaId":"29AF8474-2D7A-4C5A-82B9-7A873AD90C2E","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*","matchCriteriaId":"7781A2CA-D927-48CD-9932-AE42B7BA1EFE","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*","matchCriteriaId":"18FD08C9-5895-4BF4-BBE0-C2DDA5F6B836","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*","matchCriteriaId":"360C1B71-5360-4379-B0DE-63BB8F5E6DA2","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*","matchCriteriaId":"B16ED7C1-9881-452A-8BE0-EDDEAEFE3D7B","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*","matchCriteriaId":"ED92209F-FBD6-43F9-9A15-3842B139FCC9","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_2d:*:*:*:*:*:*","matchCriteriaId":"C37C4F29-E18F-439B-83A2-16457D04BEE1","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_2e:*:*:*:*:*:*","matchCriteriaId":"934CDD6F-E611-4693-AD30-12F35E10A75C","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_2f:*:*:*:*:*:*","matchCriteriaId":"5E33AE07-0F0F-4030-B62A-65DD086648D1","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*","matchCriteriaId":"6B701151-1B57-4E2D-A9AB-586FACEA2385","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*","matchCriteriaId":"4230B9AA-9E0C-4AE2-814D-8DD641394879","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*","matchCriteriaId":"F2FA150B-93E4-44D2-BF6D-347085A95776","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3d:*:*:*:*:*:*","matchCriteriaId":"12356603-13A5-4CC7-813A-7FF3DFC21A95","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3e:*:*:*:*:*:*","matchCriteriaId":"F0EBA616-FA2A-4A2D-918E-2D32579DA1F3","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3f:*:*:*:*:*:*","matchCriteriaId":"B275C1D0-9CFF-46DF-9630-1DD7CA060A6A","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3g:*:*:*:*:*:*","matchCriteriaId":"D47EDD24-7244-471B-8752-37AA7BAA38DC","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3h:*:*:*:*:*:*","matchCriteriaId":"BEA3431E-7C96-435E-8771-C76386374568","vulnerable":true},{"criteria":"cpe:2.3:o:vmware:esxi:8.0:update_3i:*:*:*:*:*:*","matchCriteriaId":"4802C03A-C3BC-4295-BE05-6E569E9FEB8A","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*","matchCriteriaId":"E1B59BCD-58B0-4E47-8990-80B03443DB1C","versionEndExcluding":"5.2.4","versionStartIncluding":"5.0","vulnerable":false},{"criteria":"cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"97FFC2CA-34F4-4822-93F1-0D645075462B","versionEndExcluding":"5.2","versionStartIncluding":"5.0","vulnerable":false},{"criteria":"cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:*","matchCriteriaId":"03AD0AB7-45A3-4DC7-923D-1166346EEA12","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged."}],"id":"CVE-2026-41709","lastModified":"2026-10-29T17:29:11.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"security@vmware.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41709","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-28T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-07-30T14:16:57.420","references":[{"source":"security@vmware.com","tags":["Vendor Advisory"],"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709"}],"sourceIdentifier":"security@vmware.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-778"}],"source":"security@vmware.com","type":"Secondary"}]},"severity":"LOW","source":"nvd","title":"VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to per..."}