Patch Forecast
Yellow warning
Plan into this sprint. CISA deadline for US federal agencies: 11 Nov 2026.

CVE-2026-41709 Exploited in the wild

Broadcom VMWare ESX Insufficient Logging Vulnerability

Risk score
51/100
CVSS
2.7 v3.1
Exploit chance (30 days)
0.3%
Published
30 Jul 2026
Added to CISA's exploited list
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Affected
Broadcom Vmware Esx
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Exploited in the wild

Story map

Story map: Broadcom Vmware EsxTHE FLAWSTHE FIXCVE-2026-41709Broadcom VMWare ESXInsufficient LoggingVulnerabilityCVSS 2.7 · EPSS 0% · exploitedFixApply the vendor's securityupdate; see the linked advisory.Who is exposedBroadcom Vmware EsxYELLOW · PLAN IT INBroadcomVmware EsxVMware ESX contains aninsufficient logging vulnerability.A malicious administrator couldexploit this issue to performcertain operations without thembeing logged.Where it standsExploited in the wildOn CISA's exploited list since 28 OctUS federal deadline 11 NovHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.28 Oct · CISAAdded to the Known Exploited Vulnerabilities list28 Oct · CISA advisories (US)CISA Adds Two Known Exploited Vulnerabilities toCatalog11 Nov · Deadline · to comeUS federal agencies must have patched by thenCONNECTS TOSame weaknessCWE-778 (CWE-778)2 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Broadcom Vmware Esx: Yellow, plan it in. VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

The flaws

  • CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability (CVSS 2.7 · EPSS 0% · exploited)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Broadcom Vmware Esx

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 28 Oct
  • US federal deadline 11 Nov

How it unfolded

  1. 28 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 28 Oct, CISA advisories (US) (official): CISA Adds Two Known Exploited Vulnerabilities to Catalog
  3. 11 Nov, Deadline (official): US federal agencies must have patched by then

Connects to

Why it is Yellow

  • CVSS 2.7 low
  • Exploited in the wild (CISA KEV)
  • Named in a government or vendor bulletin

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Government and vendor bulletins

References

Original description

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Last activity 28 Oct 2026. Patch Forecast updates every hour.