CVE-2026-41709

LOW

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

CVSS v3.1 Score

2.7
LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Published: 7/30/2026Modified: 10/29/2026

Related Intelligence (4)

CRITICALZero Day

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek .

CVE-2026-41709
SecurityWeek
CRITICALZero Day

China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector. The vulnerability in question is CVE-2026-41709 (CVSS score:

CVE-2026-41709
The Hacker News
HIGHVulnerability

CISA KEV: Broadcom VMware ESX — Broadcom VMWare ESX Insufficient Logging Vulnerability

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

CVE-2026-41709Broadcom VMware ESX
CISA KEV
CRITICALApt

Broadcom patches vulnerabilities all over VMware

Broadcom has addresses five vulnerabilities in its VMware product range, three of which have been accorded a “critical” rating. The affected products are: VMware ESX, VMware vCenter, VMware Workstation, VMware Fusion, VMware Cloud Foundation, VMware vSphere Foundation, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure CVE-206-59309 affects the VMware Directory Service. According t

CVE-2026-47876CVE-2026-59310
CSO Online

References (2)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017Vendor Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709US Government Resource