Security Guides

#vulnerability #CVE-2026-41709 #VMware #ESXi #vCenter #logging #server

VMware ESX CVE-2026-41709 (CVSS 2.7): CISA lists the low-severity logging flaw as exploited; patch the whole VMSA-2026-0006 and check your hosts

VMware ESX CVE-2026-41709 is a low-severity logging flaw (CVSS 2.7) that CISA added to its exploited-flaws list on October 28. Fixed ESX builds, the other bugs in VMSA-2026-0006, and how to check a host whose logs may be incomplete.

Published 2026-10-30 Updated 2026-10-30 Last verified 2026-10-30 9 min read

On this page

Who this is for: people who run VMware ESX (ESXi) or vCenter, including small teams with a few hosts, and anyone who manages a hosting or private cloud platform. This article is based on Broadcom's advisory VMSA-2026-0006, CISA's catalog data, the NVD record, and a security company's report. It does not cover attack steps or exploit code.

Patch ESX and vCenter for the whole advisory, send host logs elsewhere, and do not trust the logs alone

A low score here does not mean low risk. The flaw lets someone with administrator access act on a host without leaving the usual log entries, so a host that looks quiet may not be clean. The likelier ways in are the other flaws in the same advisory (this site's view).

Update ESX to the fixed build for your line, and update vCenter for CVE-2026-59309 and CVE-2026-59310 in the same maintenance window
Send ESXi and vCenter logs to a separate log server, so a log gap on the host can be noticed from outside
Check hosts and vCenter for signs of compromise, not only the logs: accounts, remote access settings, unfamiliar virtual machines
There is no workaround, so limiting who can reach the management network is the only stop-gap

Developing: this page will be updated as more is published

As of October 30, 2026

Not yet known

Which operations the flaw lets an administrator hide (Broadcom gives no detail)
How many organizations were affected beyond the security company's report
Whether CISA or Broadcom will publish more about the exploitation

Broadcom published VMSA-2026-0006 on July 29, 2026, with fixes. CISA added CVE-2026-41709 to its KEV catalog on October 28 (US time), due November 11, and gave no details about the exploitation.

Entry: vCenter (CVE-2026-59309 / 59310)

Authentication bypass, code execution. Fix: vCenter update

Administrator access on an ESX host

Look at accounts, access settings, virtual machines

Hiding: ESX logging (CVE-2026-41709)

Some operations are not logged. Fix: ESX update; keep logs elsewhere

Where each flaw in VMSA-2026-0006 sits in an attack. The logging flaw does not open the door; it hides what happens after (this site's framing).

What to do today

List your ESX and vCenter versions

Write down each host's build number and the vCenter version. Compare them with the fixed builds in the tables below. Hosts managed by a service provider or a hardware maker's bundle need that party's confirmation.

Plan the update for the whole advisory

CISA's due date for US federal agencies is November 11. Apply the ESX fix and the vCenter fixes together rather than ESX alone. The vCenter flaws are rated 9.8, and one was already listed as exploited in August.

Send logs to a separate server

Set ESXi syslog and vCenter syslog to forward to a log server that administrators of the hypervisor cannot edit. This does not capture an operation the flaw hides, but it keeps the surrounding records safe from deletion and makes a missing stretch visible (this site's view).

Check for compromise without relying on host logs

Review which accounts exist on each host and in vCenter, whether SSH or the shell is enabled and who enabled it, virtual machines you do not recognize, software packages you did not install, and connections from the management network that you cannot explain. Compare vCenter's task and event history with the host's own logs and look for gaps. If you find anything, treat the host and vCenter as compromised and see How to check whether your website or server was compromised.

Limit who can reach management

There is no workaround, so keep ESX and vCenter management interfaces off the internet, reachable only from a dedicated administration network, and protected by multi-factor authentication where available.

Fixed versions

2.7

CVSS v3.1 (Broadcom; Low)

Admin

Needs administrator access first

Listed Oct 28

CISA KEV (due Nov 11)

None

Workaround

Product line	Fixed for CVE-2026-41709
ESX 9.1	ESXi-9.1.0.0-25370933
ESX 9.0	ESXi-9.0.2.0100-25595025
ESX 8.0	ESXi80U3j-25429389 (update 3j)
VMware Cloud Foundation 5.x	5.2.4
Telco Cloud Platform 5.0.x and 5.1.x	KB449886

ESX 7.0 is not listed for this CVE in the advisory or in the NVD record. Broadcom does list 7.0 guidance for the Critical flaws in the same advisory, available with an extended support contract, so ask Broadcom support if you run 7.0.

The same advisory fixes the following. Use the advisory itself for the build numbers of your line.

CVE	Product	Issue	CVSS	Fixed (examples)
CVE-2026-59309	vCenter	Authentication bypass	9.8	9.1.0.0300, 9.0.2.0100, 8.0 U3k
CVE-2026-59310	vCenter	Directory traversal in the syslog server, possible code execution	9.8	Same vCenter builds. CISA KEV since August 18
CVE-2026-47876	ESX	Out-of-bounds write in the VMXNET3 network adapter, needs local admin on a VM	9.3	ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708
CVE-2026-41703	ESX	Out-of-bounds read, needs VM deployment privileges	7.6	ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3i-25205845

Note that the ESX 8.0 build that fixes CVE-2026-41709 (update 3j) is not the same as the one that fixes CVE-2026-47876 (update 3k). Moving to the latest listed build for your line is the simplest way to cover all of them, but confirm each CVE against the advisory (this site's view). For 8.0 U2f, the advisory lists a separate build for CVE-2026-47876 (ESXi80U2f-25626445) but not as a fix for CVE-2026-41709, so check the advisory if you run U2f. Broadcom's text and a calculator link also disagree on the CVSS vector for CVE-2026-47876.

What was disclosed

Insufficient logging in VMware ESX (CVE-2026-41709)

CVE: CVE-2026-41709, in Broadcom advisory VMSA-2026-0006
Type: Insufficient logging (CWE-778 in CISA's catalog)
Severity: CVSS v3.1 2.7, Low (network, high privileges required, low integrity impact). Score from Broadcom as the CVE source
Impact: A malicious administrator could perform certain operations without them being logged. Broadcom does not say which operations
Affected: ESX 9.1, 9.0 and 8.0; VMware Cloud Foundation 9.x and 5.x below 5.2.4; vSphere Foundation 9.x; Telco Cloud Platform 5.0.x and 5.1.x
Fixed: See the table above. Advisory dated July 29, 2026; the NVD record was published July 30. No workaround
Reported by: Broadcom credits a researcher at a security company
Known exploited: Added to CISA's KEV catalog on October 28, 2026 (US time) as "Broadcom VMWare ESX Insufficient Logging Vulnerability". Due date November 11. Ransomware use: unknown. The catalog entry does not mark forensic triage as required

The advisory is short on detail and the exact operations are not public in the sources this site checked. What follows is this site's reading, not a vendor statement: because the flaw needs administrator access, it is a tool for after a break-in, and its value to an attacker is that records on the host may be incomplete.

Exploitation

CISA's catalog confirms exploitation but gives no details about who was affected or how. A security company's 2026 threat report on the legal sector, which SecurityWeek reported on October 29, says that a China-linked group used this flaw as a zero-day in several intrusions at US organizations, including legal-sector targets, as late as early 2026, and SecurityWeek describes the purpose as reducing audit trail visibility. The report covers activity from September 2025 to August 2026. Broadcom credits a researcher at the same company with reporting the flaw. This site has not verified the report's data, and it does not assess who is behind the activity. Treat it as one company's account.

For defenders the practical point is timing. The company describes use as late as early 2026, months before the July 29 fix. A host that was reachable by an attacker before it was patched may have been affected even though it is now up to date (this site's view). If your hosts or vCenter were exposed to the internet or to an untrusted network in that period, check them and do not just patch.

What is not yet known

Item	Status
Which operations are not logged	Not stated by Broadcom
How many organizations were affected	Only the security company's account; unverified
Ransomware use	CISA lists it as unknown
ESX 7.0	Not listed for this CVE; Critical flaws in the advisory have separate 7.0 guidance

Sources

Checked on October 30, 2026 (Broadcom advisory revision .2, CISA catalog data, the NVD record).

Broadcom, "VMSA-2026-0006" (revision .2, updated August 19, 2026) — support.broadcom.com
CISA, Known Exploited Vulnerabilities Catalog (entries for CVE-2026-41709, added October 28, 2026, and CVE-2026-59310, added August 18, 2026) — cisa.gov
NVD, "CVE-2026-41709" — nvd.nist.gov
A security company's 2026 legal-sector threat landscape report (blog summary, English) — the report page
SecurityWeek, "Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day" (October 29, 2026) — securityweek.com

Update history

2026-10-30: First version, based on Broadcom's VMSA-2026-0006 (revision .2), CISA's October 28 KEV listing and the NVD record.

Latest breaking reports

All breaking reports →

FAQ

QWhat is CVE-2026-41709?

An insufficient logging flaw in VMware ESX, the hypervisor that runs virtual machines. Broadcom says a malicious administrator could perform certain operations without them being logged. It is rated CVSS 2.7 (Low) because the attacker already needs administrator privileges and the flaw alone does not give access or control.

QWhy does a CVSS 2.7 flaw matter?

CVSS rates the flaw in isolation. After a break-in, an attacker who can act without leaving log entries makes the break-in harder to find and to reconstruct. CISA added it to its exploited-flaws catalog on October 28, 2026, so treat it as exploited regardless of the score.

QWhich versions are fixed?

Broadcom lists ESXi-9.1.0.0-25370933 for 9.1, ESXi-9.0.2.0100-25595025 for 9.0, ESXi80U3j-25429389 for 8.0 (update 3j), VMware Cloud Foundation 5.2.4, and Telco Cloud Platform 5.0.x and 5.1.x through KB449886. There is no workaround.

QIs ESX 7.0 affected?

The advisory and the NVD record list ESX 9.1, 9.0 and 8.0 for this CVE. Version 7.0 is not listed for this CVE. The advisory does give 7.0 guidance for its Critical flaws, which sits behind an extended support contract, so check with Broadcom if you still run 7.0.

QDo I need to patch vCenter too?

Yes. The same advisory, VMSA-2026-0006, fixes two vCenter flaws rated 9.8 (CVE-2026-59309, an authentication bypass, and CVE-2026-59310, a directory traversal that can lead to code execution). CISA listed CVE-2026-59310 as exploited on August 18, 2026. Those are flaws that can serve as ways in, while CVE-2026-41709 hides what happens afterward (this site's framing).

QHow do I check whether I was hit if the logs may be incomplete?

Do not rely on host logs alone. Compare them with copies sent to a separate log server and with vCenter's own records, and check the host itself: which accounts and SSH or shell access are enabled, unfamiliar virtual machines, installed packages you did not add, and unusual connections from the management network. If anything looks wrong, treat the host as compromised.