2026-10-30
VMware ESX CVE-2026-41709 (CVSS 2.7): CISA lists the low-severity logging flaw as exploited; patch the whole VMSA-2026-0006 and check your hosts
CVE-2026-41709 is an insufficient logging flaw in VMware ESX (CVSS 2.7, Low): an attacker who already has administrator access can perform certain operations without them being recorded in the logs. Broadcom fixed it in advisory VMSA-2026-0006 on July 29, 2026, with no workaround. On October 28, 2026 (US time) CISA added it to its Known Exploited Vulnerabilities (KEV) catalog, with a due date of November 11 for US federal agencies. A security company's threat report says a China-linked group used it as a zero-day in several intrusions at US organizations, as late as early 2026, and SecurityWeek describes the purpose as reducing audit trail visibility; this site has not verified that report independently. The flaw gives no entry by itself, but it means logs from an affected host may not show what an intruder did. The same advisory includes two vCenter flaws rated 9.8, one of which (CVE-2026-59310) CISA listed as exploited on August 18, so patching only the ESX flaw leaves the entry points open. This site's conclusion: update ESX and vCenter to the fixed builds for the whole advisory, send host logs to a separate server, and look for signs of compromise instead of trusting the logs alone.