{"id":"CVE-2026-41709","title":"ESX insufficient logging vulnerability","summary":"VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-778"],"vendor":"VMware","product":"Cloud Foundation","affected":["cloud_foundation 9.1.x.x","cloud_foundation 9.0.x.x","cloud_foundation >= 5.x < 5.2.4","vsphere_foundation 9.1.x.x","vsphere_foundation 9.0.x.x","ESX >= 9.1.x.x < ESXi-9.1.0.0-25370933","ESX >= 9.0.x.x < ESXi-9.0.2.0100-25595025","ESX >= 8.0 < ESXi80U3j-25429389","telco_cloud_platform 5.1.x","telco_cloud_platform 5.0.x"],"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T00:00:00+00:00"},"exploited":true,"exploitAvailable":true,"published":"2026-07-30","updated":"2026-10-29","sourceUpdated":"2026-10-29T03:56:50.795Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41709","references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"}],"tags":["cve.org","in-the-wild","exploit-available","kev"],"epss":0.00689,"epssPercentile":0.52718,"kev":true,"kevDateAdded":"2026-10-28","kevDueDate":"2026-11-11","kevRansomware":false,"ingestedAt":"2026-10-31T04:17:25.415Z","slug":"CVE-2026-41709","body":"## Overview\n\nVMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.\n\n## Affected\n\n- `cloud_foundation 9.1.x.x`\n- `cloud_foundation 9.0.x.x`\n- `cloud_foundation >= 5.x < 5.2.4`\n- `vsphere_foundation 9.1.x.x`\n- `vsphere_foundation 9.0.x.x`\n- `ESX >= 9.1.x.x < ESXi-9.1.0.0-25370933`\n- `ESX >= 9.0.x.x < ESXi-9.0.2.0100-25595025`\n- `ESX >= 8.0 < ESXi80U3j-25429389`\n- `telco_cloud_platform 5.1.x`\n- `telco_cloud_platform 5.0.x`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":14.9,"likelihood":0.1,"exploitation":25,"ransomware":0},"changes":[]}