{
  "cvss": 2.7,
  "datePublished": "2026-07-30T14:16:57.420",
  "dateUpdated": "2026-10-29T17:29:11.590",
  "description": "VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.",
  "id": "CVE-2026-41709",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Cloud Foundation",
            "vendor": "VMware",
            "versions": [
              {
                "status": "affected",
                "version": "9.1.x.x"
              },
              {
                "status": "affected",
                "version": "9.0.x.x"
              },
              {
                "lessThan": "5.2.4",
                "status": "affected",
                "version": "5.x",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "vSphere Foundation",
            "vendor": "VMware",
            "versions": [
              {
                "status": "affected",
                "version": "9.1.x.x"
              },
              {
                "status": "affected",
                "version": "9.0.x.x"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ESX",
            "vendor": "VMware",
            "versions": [
              {
                "lessThan": "ESXi-9.1.0.0-25370933",
                "status": "affected",
                "version": "9.1.x.x",
                "versionType": "custom"
              },
              {
                "lessThan": "ESXi-9.0.2.0100-25595025",
                "status": "affected",
                "version": "9.0.x.x",
                "versionType": "custom"
              },
              {
                "lessThan": "ESXi80U3j-25429389",
                "status": "affected",
                "version": "8.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "Telco Cloud Platform",
            "vendor": "VMware",
            "versions": [
              {
                "status": "affected",
                "version": "5.1.x"
              },
              {
                "status": "affected",
                "version": "5.0.x"
              }
            ]
          }
        ],
        "source": "security@vmware.com"
      }
    ],
    "cisaActionDue": "2026-11-11",
    "cisaExploitAdd": "2026-10-28",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "Broadcom VMWare ESX Insufficient Logging Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D7DC2815-CD13-42DC-96E5-412CFB768A6A",
                "versionEndExcluding": "9.0.2.0100",
                "versionStartIncluding": "9.0.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*",
                "matchCriteriaId": "7A1A402A-9262-4B97-A0B7-E5AE045E394D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*",
                "matchCriteriaId": "FE44B379-9943-4DD1-8514-26F87482AFA8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*",
                "matchCriteriaId": "2A797377-8945-4D75-AA68-A768855E5842",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*",
                "matchCriteriaId": "79D84D76-54BE-49E9-905C-7D65B4B42D68",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:d:*:*:*:*:*:*",
                "matchCriteriaId": "E3BC5C77-258A-4920-B217-396212056B14",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:e:*:*:*:*:*:*",
                "matchCriteriaId": "17D484EB-037C-46E2-ADDF-846B3A02843F",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:f:*:*:*:*:*:*",
                "matchCriteriaId": "9E689385-7521-4A7A-B81E-DD84A3B58238",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:g:*:*:*:*:*:*",
                "matchCriteriaId": "69E59579-57D6-40BA-98FA-28D3C41BA222",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*",
                "matchCriteriaId": "2F8767F7-7C3D-457D-9EAC-E8A30796F751",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*",
                "matchCriteriaId": "29AF8474-2D7A-4C5A-82B9-7A873AD90C2E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*",
                "matchCriteriaId": "7781A2CA-D927-48CD-9932-AE42B7BA1EFE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*",
                "matchCriteriaId": "18FD08C9-5895-4BF4-BBE0-C2DDA5F6B836",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*",
                "matchCriteriaId": "360C1B71-5360-4379-B0DE-63BB8F5E6DA2",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*",
                "matchCriteriaId": "B16ED7C1-9881-452A-8BE0-EDDEAEFE3D7B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*",
                "matchCriteriaId": "ED92209F-FBD6-43F9-9A15-3842B139FCC9",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2d:*:*:*:*:*:*",
                "matchCriteriaId": "C37C4F29-E18F-439B-83A2-16457D04BEE1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2e:*:*:*:*:*:*",
                "matchCriteriaId": "934CDD6F-E611-4693-AD30-12F35E10A75C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2f:*:*:*:*:*:*",
                "matchCriteriaId": "5E33AE07-0F0F-4030-B62A-65DD086648D1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*",
                "matchCriteriaId": "6B701151-1B57-4E2D-A9AB-586FACEA2385",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*",
                "matchCriteriaId": "4230B9AA-9E0C-4AE2-814D-8DD641394879",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*",
                "matchCriteriaId": "F2FA150B-93E4-44D2-BF6D-347085A95776",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3d:*:*:*:*:*:*",
                "matchCriteriaId": "12356603-13A5-4CC7-813A-7FF3DFC21A95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3e:*:*:*:*:*:*",
                "matchCriteriaId": "F0EBA616-FA2A-4A2D-918E-2D32579DA1F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3f:*:*:*:*:*:*",
                "matchCriteriaId": "B275C1D0-9CFF-46DF-9630-1DD7CA060A6A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3g:*:*:*:*:*:*",
                "matchCriteriaId": "D47EDD24-7244-471B-8752-37AA7BAA38DC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3h:*:*:*:*:*:*",
                "matchCriteriaId": "BEA3431E-7C96-435E-8771-C76386374568",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3i:*:*:*:*:*:*",
                "matchCriteriaId": "4802C03A-C3BC-4295-BE05-6E569E9FEB8A",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "E1B59BCD-58B0-4E47-8990-80B03443DB1C",
                "versionEndExcluding": "5.2.4",
                "versionStartIncluding": "5.0",
                "vulnerable": false
              },
              {
                "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "97FFC2CA-34F4-4822-93F1-0D645075462B",
                "versionEndExcluding": "5.2",
                "versionStartIncluding": "5.0",
                "vulnerable": false
              },
              {
                "criteria": "cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "03AD0AB7-45A3-4DC7-923D-1166346EEA12",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged."
      }
    ],
    "id": "CVE-2026-41709",
    "lastModified": "2026-10-29T17:29:11.590",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 1.4,
          "source": "security@vmware.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-41709",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-28T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-07-30T14:16:57.420",
    "references": [
      {
        "source": "security@vmware.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709"
      }
    ],
    "sourceIdentifier": "security@vmware.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-778"
          }
        ],
        "source": "security@vmware.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "LOW",
  "source": "nvd",
  "title": "VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to per..."
}