CISA flags actively exploited VMware ESX logging flaw in KEV

CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalogue on 28 October 2026. The vulnerability affects Broadcom VMware ESX and is an insufficient logging flaw that could let an attacker with administrator access perform certain operations without those actions being recorded.

The flaw concerns inadequate logging, rather than a stated means of gaining access. An attacker must already have administrator access to perform the affected operations. The supplied data does not describe a remote attack vector or specify which operations may go unlogged. The CVSS score is 2.7, rated Low.

Patch status is unknown, and no patch or advisory URL was provided; Broadcom’s security advisory is available at https://support.broadcom[.]com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017.

CISA’s KEV listing indicates that the vulnerability is being actively exploited. Use in ransomware campaigns is unknown. CISA set a remediation deadline of 11 November 2026. The available information does not identify the threat actors or provide further details about exploitation.

CISA requires Federal Civilian Executive Branch (FCEB) agencies to apply mitigations in line with vendor instructions and applicable BOD 26-04 guidance, including its forensics triage requirements. For cloud services, agencies should follow the applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and follow BOD 26-04 patching guidance. All organisations should review their exposure to VMware ESX and consult Broadcom’s instructions for applicable mitigations.

See the linked NVD entry at https://nvd.nist[.]gov/vuln/detail/CVE-2026-41709 and CISA KEV catalogue at https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog for full details.