VMware ESX: insufficient logging flaw (CVE-2026-41709) exploited in the wild, fixed builds available
Published 29/10/2026 10:24
Timeline
4 events over 2 d 9 h
- 27/10/2026CorroboratedVulnCheck KEV+1 d
- 28/10/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 28/10/2026ExploitedCISA Known Exploited Vulnerabilities+1 d 9 h
- 29/10/2026 10:24Published on WatchtowerPro CISO
In short
VMware ESX has an insufficient logging flaw that lets a malicious administrator perform certain operations without them being logged. Broadcom published it on 29/07/2026 as part of VMSA-2026-0006. VulnCheck KEV listed it as exploited on 27/10/2026, citing a CrowdStrike report, and CISA added it to its Known Exploited Vulnerabilities catalog on 28/10/2026. The vendor scores it 2.7 (Low). GreyNoise reports a public exploit for CVE-2026-41709; listed by CISA as known exploited (29/10/2026).
How bad is it
Low. An attacker who already has administrator rights on a VMware ESX host can carry out certain actions without them being recorded in the logs, which makes their activity harder to detect.
Being exploited.
Severity score
CVSS from the vendor, via our research, read 29/10/2026.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- VMware ESX: any version before the fixed builds is affected (9.1.x before ESXi-9.1.0.0-25370933, 9.0.x before ESXi-9.0.2.0100-25595025, 8.0 before ESXi80U3j-25429389).
- Any product that contains ESX is also affected, including VMware Cloud Foundation, vSphere Foundation, Telco Cloud Platform and Telco Cloud Infrastructure.
- The NVD record also lists Cloud Foundation 9.1.x, 9.0.x and 5.x before 5.2.4, vSphere Foundation 9.1.x and 9.0.x, and Telco Cloud Platform 5.1.x and 5.0.x.
What to do now
- Update ESX to the fixed build for your branch: ESXi-9.1.0.0-25370933 (9.1.x), ESXi-9.0.2.0100-25595025 (9.0.x) or ESXi80U3j-25429389 (8.0), or a newer cumulative version. Check the build numbers against Broadcom advisory VMSA-2026-0006.
- ESX updates are in the online depot and available through vSphere Lifecycle Manager. If they do not appear, run a depot sync in vCenter.
- Products that contain ESX (VMware Cloud Foundation, vSphere Foundation, Telco Cloud Platform, Telco Cloud Infrastructure) also need the update.
- On vSphere 7.0, customers with an extended support contract must request patches from Broadcom; others should plan an upgrade, ideally to VCF 9.1.
- Apply the other fixes in the same advisory as well, as it covers more serious vCenter and ESX issues.
- No vendor workaround is known from the sources; any interim measure only reduces exposure and does not make a host safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 3 open questions, followed up as sources answer and all 4 sources with their dates. And technology matching: which of your systems run Broadcom VMWare ESX, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Broadcom VMware ESX - Broadcom VMWare ESX Insufficient Logging Vulnerability Vendor · Known exploited (VulnCheck KEV): VMware ESX - VMware cloud_foundation Insufficient Logging Research · NVD - CVE-2026-41709 Research