VMware ESX CVE-2026-41709 Exploited Logging Flaw Added to KEV Oct. 28

I noticed that CISA added VMware ESX CVE-2026-41709 to KEV on Oct. 28, 2026, so I went back and read the full Broadcom advisory. A CVSS score of just 2.7 sounds easy to overlook, even though CISA has confirmed exploitation in the wild.

What happened

CVE-2026-41709 is a CWE-778 (insufficient logging) vulnerability in VMware ESX. According to Broadcom, a "malicious administrator" can perform certain actions without those actions being logged. Ian Barton of CrowdStrike reported it. The main advisory is VMSA-2026-0006, first published on July 29, 2026 and last updated to revision .2 on Aug. 19, 2026, covering 5 CVEs in one advisory.

Put simply, this vulnerability does not give someone access to the machine. It lets someone who already has access and administrator privileges act without leaving a trace, which is exactly what an intruder wants after gaining administrator privileges: to keep the investigation team from seeing what they did.

Severity

• CVSS 3.1: 2.7 (Low) Vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. PR:H means high privileges are already required, which keeps the score low.
• CISA KEV: Added on Oct. 28, 2026, with a KEV remediation deadline of Nov. 11, 2026. The SSVC data in the CVE record lists exploitation as active and automatable as no.
• Ransomware: The KEV feed I obtained lists this as Unknown.

A Low score and a KEV listing do not contradict each other. The score measures only what the vulnerability can do on its own, not what attackers combine it with. In a real incident, a vulnerability that hides traces is valuable when combined with other stages of an attack. That is why I do not want anyone to see 2.7 and postpone it indefinitely.

The same advisory includes much more severe vulnerabilities, such as CVE-2026-59310 (vCenter, directory traversal in the Syslog server, CVSS 9.8), which CISA added to KEV on Aug. 18, 2026. If you are patching ESX this time, check the vCenter side of the same advisory too.

Affected and fixed releases

The numbers below come from VMSA-2026-0006 and the CVE record for CVE-2026-41709.

The products listed as affected in the CVE record include VMware Cloud Foundation 9.1, 9.0 and 5.x before 5.2.4, vSphere Foundation 9.1 and 9.0, and Telco Cloud Platform 5.0 and 5.1. If your machine runs a release with no fixed version listed in the table, or a build newer than the one shown, open the original advisory and check whether it includes the fix. I will not guess for you. The instruction in the same advisory to contact Broadcom Support for ESX/vCenter 7.0 applies to other Critical vulnerabilities, not this one.

How to fix it

Broadcom states that there is no workaround. The only option is to install a fixed build. First, check the current build from the ESXi shell.

# ดูรุ่นและ build ของ ESXi
esxcli system version get
vmware -vl

Compare the build number returned (the number at the end of the build, such as 25595025) with the table above. If it is lower, the fix is not installed. For the update procedure, follow Broadcom's documentation for vSphere Lifecycle Manager or an offline bundle, whichever your organization uses. I am not including patch commands here because each organization uses a different method, and maintenance mode and vMotion need to be planned correctly first.

Example of configuring a syslog destination (using sample values)

esxcli system syslog config set --loghost='udp://192.168.10.50:514'
esxcli system syslog reload
esxcli network firewall ruleset set -r syslog -e true
esxcli system syslog config get

The order I recommend

1. Check the build on every host and compare it with the table above.
2. Configure an off-host syslog destination. You can do this before patching because it does not require a reboot.
3. Schedule patching through maintenance mode, one host at a time.
4. Check the build again after patching, and review the vCenter side of the same advisory.

After configuration, verify that logs are actually being forwarded.

esxcli system syslog mark --message="syslog forward test"

Then search for that message on the log receiver. If you cannot find it, the destination or firewall configuration is still incorrect.

Check whether you have been compromised

Based on the material I read, Broadcom and CISA have not published IOCs for attacks exploiting this vulnerability. And because the vulnerability leaves some actions unlogged, searching ESX's own logs cannot provide full confidence. What you can realistically do is examine what surrounds the gaps.

• Review SSH administrator accounts and accounts in vCenter for unfamiliar or newly created entries.
• Check whether SSH and ESXi Shell have been left enabled unnecessarily.
• Look for unusual gaps in the logs by comparing them with external syslog records (if you were already collecting them).
• If you suspect an intruder has gained administrator privileges, treat events during that period as incompletely accounted for, change passwords and review all permissions.

There is a report from 1 secondary website linking this vulnerability to a particular threat group. I could not find confirmation from official sources, so I have left those details out.

For Proxmox users

This CVE affects VMware products. Proxmox VE users do not run ESX code, so it does not directly apply, but the principle of forwarding logs off-host applies just as well.

Personally, if I had ESX running a build below those in the table, with management access available from multiple locations, I would schedule patching before the Nov. 11 KEV deadline without waiting for the regular cycle, because VM migrations need to be scheduled anyway. If management access were on a separate network with only a few people able to connect, I could delay a little, but I would finish setting up off-host syslog first, which takes only a few minutes.

P.S. If you still use ESX 7.0, the advisory does not list a fixed release for CVE-2026-41709 (for the other Critical vulnerabilities in the same advisory, Broadcom tells customers with extended support contracts to contact Support). I therefore cannot say whether a fix is available for 7.0. Ask Broadcom directly.

Sources: Broadcom VMSA-2026-0006 (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017), CVE record CVE-2026-41709 (https://www.cve.org/CVERecord?id=CVE-2026-41709), CVE record CVE-2026-59310 (https://www.cve.org/CVERecord?id=CVE-2026-59310), CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Information current as of Nov. 5, 2026. If Broadcom updates the advisory or more attack details become available, I will come back and update this article.