CVE Details

CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
Published: 2026-10-28 CVSS: 2.7 LOW Product: Broadcom VMware ESX Due Date: 2026-11-11

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 2.7
  • Severity: LOW
  • Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: partial

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-41709
cveMetadata > assignerOrgId dcf2e128-44bd-42ed-91e8-88f912c1401d
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName vmware
cveMetadata > dateReserved 2026-04-22T06:21:34.490Z
cveMetadata > datePublished 2026-07-30T12:45:02.292Z
cveMetadata > dateUpdated 2026-10-28T19:59:22.994Z
containers > cna > providerMetadata > orgId dcf2e128-44bd-42ed-91e8-88f912c1401d
containers > cna > providerMetadata > shortName vmware
containers > cna > providerMetadata > dateUpdated 2026-07-30T12:45:02.292Z
containers > cna > title ESX insufficient logging vulnerability
containers > cna > datePublic 2026-07-29T04:30:00.000Z
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-778
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-778 Insufficient logging
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > affected > 0 > vendor VMware
containers > cna > affected > 0 > product Cloud Foundation
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 9.1.x.x
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version 9.0.x.x
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > version 5.x
containers > cna > affected > 0 > versions > 2 > lessThan 5.2.4
containers > cna > affected > 0 > versions > 2 > versionType custom
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 1 > vendor VMware
containers > cna > affected > 1 > product vSphere Foundation
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > version 9.1.x.x
containers > cna > affected > 1 > versions > 1 > status affected
containers > cna > affected > 1 > versions > 1 > version 9.0.x.x
containers > cna > affected > 1 > defaultStatus unaffected
containers > cna > affected > 2 > vendor VMware
containers > cna > affected > 2 > product ESX
containers > cna > affected > 2 > versions > 0 > status affected
containers > cna > affected > 2 > versions > 0 > version 9.1.x.x
containers > cna > affected > 2 > versions > 0 > lessThan ESXi-9.1.0.0-25370933
containers > cna > affected > 2 > versions > 0 > versionType custom
containers > cna > affected > 2 > versions > 1 > status affected
containers > cna > affected > 2 > versions > 1 > version 9.0.x.x
containers > cna > affected > 2 > versions > 1 > lessThan ESXi-9.0.2.0100-25595025
containers > cna > affected > 2 > versions > 1 > versionType custom
containers > cna > affected > 2 > versions > 2 > status affected
containers > cna > affected > 2 > versions > 2 > version 8.0
containers > cna > affected > 2 > versions > 2 > lessThan ESXi80U3j-25429389
containers > cna > affected > 2 > versions > 2 > versionType custom
containers > cna > affected > 2 > defaultStatus unaffected
containers > cna > affected > 3 > vendor VMware
containers > cna > affected > 3 > product Telco Cloud Platform
containers > cna > affected > 3 > versions > 0 > status affected
containers > cna > affected > 3 > versions > 0 > version 5.1.x
containers > cna > affected > 3 > versions > 1 > status affected
containers > cna > affected > 3 > versions > 1 > version 5.0.x
containers > cna > affected > 3 > defaultStatus unaffected
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
containers > cna > descriptions > 0 > supportingMedia > 0 > type text/html
containers > cna > descriptions > 0 > supportingMedia > 0 > base64 False
containers > cna > descriptions > 0 > supportingMedia > 0 > value VMware ESX contains an insufficient logging vulnerability.&nbsp;<span>A malicious administrator could exploit this issue to perform certain operations without them being logged.</span><br><br>
containers > cna > references > 0 > url https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired HIGH
containers > cna > metrics > 0 > cvssV3_1 > userInteraction NONE
containers > cna > metrics > 0 > cvssV3_1 > scope UNCHANGED
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact NONE
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact LOW
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact NONE
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity LOW
containers > cna > metrics > 0 > cvssV3_1 > baseScore 2.7
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
containers > cna > source > discovery UNKNOWN
containers > cna > x_generator > engine Vulnogram 1.0.4
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-41709
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact partial
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-10-28T19:50:06.869680Z
containers > adp > 0 > metrics > 1 > other > type kev
containers > adp > 0 > metrics > 1 > other > content > dateAdded 2026-10-28
containers > adp > 0 > metrics > 1 > other > content > reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > timeline > 0 > time 2026-10-28T00:00:00.000Z
containers > adp > 0 > timeline > 0 > lang en
containers > adp > 0 > timeline > 0 > value CVE-2026-41709 added to CISA KEV
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-10-28T19:59:22.994Z