CVE-2026-41709: Broadcom VMware ESXi Admin-Action Logging Bypass (KEV)

CVE-2026-41709 is an insufficient-logging flaw in Broadcom VMware ESXi (CWE-778) that lets an attacker who already holds administrative access to the host perform certain operations without those actions appearing in ESXi's logs, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-28 citing active exploitation, even though the flaw's own CVSS score is low because it requires existing admin privileges.

CVE-2026-41709 is an insufficient logging vulnerability (CWE-778) in Broadcom VMware ESX/ESXi. Broadcom's advisory VMSA-2026-0006.2 states plainly: "VMware ESX contains an insufficient logging vulnerability," and that "a malicious administrator could exploit this issue to perform certain operations without them being logged" (Broadcom Security Advisory VMSA-2026-0006.2).

As of 2026-10-28, NVD lists the record as "Undergoing Analysis" — its own independent review is not yet complete. The only CVSS score on file is Broadcom's own Secondary rating of CVSS v3.1 2.7 (low), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N: network-reachable but requiring high privileges already, with only a low integrity impact. No NVD Primary score has been published, so this low number is Broadcom's own CNA rating, not an NVD-confirmed figure, and it should not be read as understating urgency — the flaw's value to an attacker is specifically that it hides actions from logs after privileged access has already been obtained (NVD).

VMSA-2026-0006.2 lists the affected products as VMware ESX 8.0, 9.0.x.x and 9.1.x.x, VMware Cloud Foundation 5.x/9.0.x.x/9.1.x.x, and VMware Telco Cloud Platform 5.0.x/5.1.x (both of which bundle ESXi), with fixed builds ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j and VCF 5.2.4, and states explicitly that there are no workarounds (Broadcom Security Advisory VMSA-2026-0006.2).

CISA added CVE-2026-41709 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-28, with a required-action due date of 2026-11-11, describing it as letting "a malicious actor with admin access perform certain operations without being logged"; the catalog records known ransomware campaign use as "Unknown" and does not require forensic triage for this entry. CISA's structured decision record (SSVC), timestamped the same day, marks exploitation as "active," the flaw as not automatable, and its technical impact as "partial" (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.0030 (22nd percentile) — a low figure consistent with a flaw that requires an attacker to already hold administrative access rather than one that grants initial entry (FIRST EPSS).

Because exploitation already requires admin-level access to the ESXi host, this flaw matters most as an anti-forensics technique used after a host is compromised — for example by an intruder or ransomware operator covering their tracks. Any VMware ESXi 8.0, 9.0.x or 9.1.x host, including those running inside VMware Cloud Foundation or Telco Cloud Platform, should be updated to the fixed builds above, and administrators should treat the thin audit trail this flaw produces as a reason to review host-level activity and admin account use more closely, not less.

• VMware ESX contains an insufficient logging vulnerability that lets a malicious administrator perform certain operations without them being logged. — Broadcom Security Advisory VMSA-2026-0006.2
• NVD status is Undergoing Analysis as of 2026-10-28; the only CVSS metric is Broadcom's own Secondary CVSS v3.1 score of 2.7, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N; no NVD Primary score published. — NVD
• Affected: ESX 8.0, 9.0.x.x, 9.1.x.x; VMware Cloud Foundation 5.x/9.0.x.x/9.1.x.x; VMware Telco Cloud Platform 5.0.x/5.1.x. Fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j, VCF 5.2.4. No workarounds. — Broadcom Security Advisory VMSA-2026-0006.2
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-28, required-action due date 2026-11-11, ransomware campaign use listed as Unknown, no forensic triage required; CISA SSVC record marks exploitation active, not automatable, technical impact partial. — CISA KEV
• EPSS score is 0.0030 (22nd percentile) as of 2026-10-28. — FIRST EPSS