{"id":"CVE-2026-41709","aliases":[],"cve":{"records":[{"id":"CVE-2026-41709","source":"vmware","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-04-22T06:21:34.490Z","published":"2026-07-30T12:45:02.292Z","modified":"2026-10-29T03:56:50.795Z"}],"publishers":[{"name":"vmware","role":"CNA","organizationId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","modified":"2026-07-30T12:45:02.292Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T03:56:50.795Z"}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","tags":[],"source":"vmware"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709","tags":["government-resource"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-778","description":"CWE-778 Insufficient logging","source":"vmware"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-28T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"active"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ESX insufficient logging vulnerability","titleSource":"vmware","descriptionSource":"vmware","description":"VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.","score":2.7,"severity":"low","published":"2026-07-30T12:45:02.292Z","modified":"2026-10-29T03:56:50.795Z","withdrawn":false,"knownExploited":true,"affected":[],"products":[{"vendor":"VMware","name":"Cloud Foundation","platforms":[],"versions":[{"version":"9.1.x.x","status":"affected"},{"version":"9.0.x.x","status":"affected"},{"version":"5.x","status":"affected","lessThan":"5.2.4","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"vmware","url":"https://www.cve.org/CVERecord?id=CVE-2026-41709"},{"vendor":"VMware","name":"vSphere Foundation","platforms":[],"versions":[{"version":"9.1.x.x","status":"affected"},{"version":"9.0.x.x","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"vmware","url":"https://www.cve.org/CVERecord?id=CVE-2026-41709"},{"vendor":"VMware","name":"ESX","platforms":[],"versions":[{"version":"9.1.x.x","status":"affected","lessThan":"ESXi-9.1.0.0-25370933","versionType":"custom"},{"version":"9.0.x.x","status":"affected","lessThan":"ESXi-9.0.2.0100-25595025","versionType":"custom"},{"version":"8.0","status":"affected","lessThan":"ESXi80U3j-25429389","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"vmware","url":"https://www.cve.org/CVERecord?id=CVE-2026-41709"},{"vendor":"VMware","name":"Telco Cloud Platform","platforms":[],"versions":[{"version":"5.1.x","status":"affected"},{"version":"5.0.x","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"vmware","url":"https://www.cve.org/CVERecord?id=CVE-2026-41709"}],"remediation":[],"references":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709"],"sources":[{"name":"CVE","id":"CVE-2026-41709","modified":"2026-10-29T03:56:50.795Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-41709"}],"assessments":[{"source":"vmware","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","score":2.7}],"sourceAffected":[],"observedAt":"2026-10-29T14:38:06.534Z","kev":{"status":"listed","checkedAt":"2026-11-05T06:55:32.098Z","cveID":"CVE-2026-41709","vendorProject":"Broadcom","product":"VMware ESX","vulnerabilityName":"Broadcom VMWare ESX Insufficient Logging Vulnerability","dateAdded":"2026-10-28","shortDescription":"Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","dueDate":"2026-11-11","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-41709","cwes":["CWE-778"]},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T21:45:32.604Z","attemptedAt":"2026-10-28T21:45:32.604Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T21:45:32.362Z","attemptedAt":"2026-10-28T21:45:32.362Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T21:45:32.897Z","attemptedAt":"2026-10-28T21:45:32.897Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T21:45:31.845Z","attemptedAt":"2026-10-28T21:45:31.845Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-41709","url":"https://www.first.org/epss/","probability":0.00297,"percentile":0.22291,"date":"2026-10-28","checkedAt":"2026-10-28T21:45:31.845Z"},{"source":"GitHub Advisory Database","id":"GHSA-vpqj-56x2-gp9p","url":"https://github.com/advisories/GHSA-vpqj-56x2-gp9p","modified":"2026-10-28T21:31:54Z","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-28T21:45:32.362Z"},{"source":"NVD","id":"CVE-2026-41709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41709","modified":"2026-10-28T20:17:25.583","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-28T21:45:32.604Z"},{"source":"ENISA EUVD","id":"EUVD-2026-51107","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51107","modified":"Oct 28, 2026, 7:59:22 PM","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-10-28T21:45:32.897Z"}],"aiSummary":{"text":"VMware ESX has an insufficient logging vulnerability, which a malicious administrator could exploit to perform operations without logging. Affected versions include 8.0, 9.0.x.x, and 9.1.x.x.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:55:45.328Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-41709"}]}}