CVE-2026-41709
Full vulnerability record from the local CVENow database.
Description
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Severity
LOW
CVSS score
2.7
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-30 14:16:57.420000
Last modified
2026-10-29 17:29:11.590000
View original CVE JSON
{
"id": "CVE-2026-41709",
"sourceIdentifier": "[email protected]",
"published": "2026-07-30T14:16:57.420",
"lastModified": "2026-10-29T17:29:11.590",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "VMware",
"product": "Cloud Foundation",
"defaultStatus": "unaffected",
"versions": [
{
"version": "9.1.x.x",
"status": "affected"
},
{
"version": "9.0.x.x",
"status": "affected"
},
{
"version": "5.x",
"lessThan": "5.2.4",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "VMware",
"product": "vSphere Foundation",
"defaultStatus": "unaffected",
"versions": [
{
"version": "9.1.x.x",
"status": "affected"
},
{
"version": "9.0.x.x",
"status": "affected"
}
]
},
{
"vendor": "VMware",
"product": "ESX",
"defaultStatus": "unaffected",
"versions": [
{
"version": "9.1.x.x",
"lessThan": "ESXi-9.1.0.0-25370933",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.0.x.x",
"lessThan": "ESXi-9.0.2.0100-25595025",
"versionType": "custom",
"status": "affected"
},
{
"version": "8.0",
"lessThan": "ESXi80U3j-25429389",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "VMware",
"product": "Telco Cloud Platform",
"defaultStatus": "unaffected",
"versions": [
{
"version": "5.1.x",
"status": "affected"
},
{
"version": "5.0.x",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 2.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.2,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-28T00:00:00+00:00",
"id": "CVE-2026-41709",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"cisaExploitAdd": "2026-10-28",
"cisaActionDue": "2026-11-11",
"cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"cisaVulnerabilityName": "Broadcom VMWare ESX Insufficient Logging Vulnerability",
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-778"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.0.0",
"versionEndExcluding": "9.0.2.0100",
"matchCriteriaId": "D7DC2815-CD13-42DC-96E5-412CFB768A6A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*",
"matchCriteriaId": "7A1A402A-9262-4B97-A0B7-E5AE045E394D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*",
"matchCriteriaId": "FE44B379-9943-4DD1-8514-26F87482AFA8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*",
"matchCriteriaId": "2A797377-8945-4D75-AA68-A768855E5842"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*",
"matchCriteriaId": "79D84D76-54BE-49E9-905C-7D65B4B42D68"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:d:*:*:*:*:*:*",
"matchCriteriaId": "E3BC5C77-258A-4920-B217-396212056B14"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:e:*:*:*:*:*:*",
"matchCriteriaId": "17D484EB-037C-46E2-ADDF-846B3A02843F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:f:*:*:*:*:*:*",
"matchCriteriaId": "9E689385-7521-4A7A-B81E-DD84A3B58238"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:g:*:*:*:*:*:*",
"matchCriteriaId": "69E59579-57D6-40BA-98FA-28D3C41BA222"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*",
"matchCriteriaId": "2F8767F7-7C3D-457D-9EAC-E8A30796F751"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*",
"matchCriteriaId": "29AF8474-2D7A-4C5A-82B9-7A873AD90C2E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*",
"matchCriteriaId": "7781A2CA-D927-48CD-9932-AE42B7BA1EFE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*",
"matchCriteriaId": "18FD08C9-5895-4BF4-BBE0-C2DDA5F6B836"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*",
"matchCriteriaId": "360C1B71-5360-4379-B0DE-63BB8F5E6DA2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*",
"matchCriteriaId": "B16ED7C1-9881-452A-8BE0-EDDEAEFE3D7B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*",
"matchCriteriaId": "ED92209F-FBD6-43F9-9A15-3842B139FCC9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2d:*:*:*:*:*:*",
"matchCriteriaId": "C37C4F29-E18F-439B-83A2-16457D04BEE1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2e:*:*:*:*:*:*",
"matchCriteriaId": "934CDD6F-E611-4693-AD30-12F35E10A75C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2f:*:*:*:*:*:*",
"matchCriteriaId": "5E33AE07-0F0F-4030-B62A-65DD086648D1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*",
"matchCriteriaId": "6B701151-1B57-4E2D-A9AB-586FACEA2385"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*",
"matchCriteriaId": "4230B9AA-9E0C-4AE2-814D-8DD641394879"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*",
"matchCriteriaId": "F2FA150B-93E4-44D2-BF6D-347085A95776"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3d:*:*:*:*:*:*",
"matchCriteriaId": "12356603-13A5-4CC7-813A-7FF3DFC21A95"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3e:*:*:*:*:*:*",
"matchCriteriaId": "F0EBA616-FA2A-4A2D-918E-2D32579DA1F3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3f:*:*:*:*:*:*",
"matchCriteriaId": "B275C1D0-9CFF-46DF-9630-1DD7CA060A6A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3g:*:*:*:*:*:*",
"matchCriteriaId": "D47EDD24-7244-471B-8752-37AA7BAA38DC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3h:*:*:*:*:*:*",
"matchCriteriaId": "BEA3431E-7C96-435E-8771-C76386374568"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3i:*:*:*:*:*:*",
"matchCriteriaId": "4802C03A-C3BC-4295-BE05-6E569E9FEB8A"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.0",
"versionEndExcluding": "5.2.4",
"matchCriteriaId": "E1B59BCD-58B0-4E47-8990-80B03443DB1C"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.0",
"versionEndExcluding": "5.2",
"matchCriteriaId": "97FFC2CA-34F4-4822-93F1-0D645075462B"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:*",
"matchCriteriaId": "03AD0AB7-45A3-4DC7-923D-1166346EEA12"
}
]
}
]
}
],
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
]
}
]
}