---
id: CVE-2026-41709
title: ESX insufficient logging vulnerability
summary: "VMware ESX contains an insufficient logging vulnerability.\_A malicious administrator could exploit this issue to perform certain operations without them being logged."
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-778
vendor: VMware
product: Cloud Foundation
affected:
  - cloud_foundation 9.1.x.x
  - cloud_foundation 9.0.x.x
  - cloud_foundation >= 5.x < 5.2.4
  - vsphere_foundation 9.1.x.x
  - vsphere_foundation 9.0.x.x
  - ESX >= 9.1.x.x < ESXi-9.1.0.0-25370933
  - ESX >= 9.0.x.x < ESXi-9.0.2.0100-25595025
  - ESX >= 8.0 < ESXi80U3j-25429389
  - telco_cloud_platform 5.1.x
  - telco_cloud_platform 5.0.x
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T00:00:00+00:00'
exploited: true
exploitAvailable: true
published: '2026-07-30'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T03:56:50.795Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-41709'
references:
  - url: >-
      https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
tags:
  - cve.org
  - in-the-wild
  - exploit-available
  - kev
epss: 0.00689
epssPercentile: 0.52718
kev: true
kevDateAdded: '2026-10-28'
kevDueDate: '2026-11-11'
kevRansomware: false
ingestedAt: '2026-10-31T04:17:25.415Z'
---

## Overview

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

## Affected

- `cloud_foundation 9.1.x.x`
- `cloud_foundation 9.0.x.x`
- `cloud_foundation >= 5.x < 5.2.4`
- `vsphere_foundation 9.1.x.x`
- `vsphere_foundation 9.0.x.x`
- `ESX >= 9.1.x.x < ESXi-9.1.0.0-25370933`
- `ESX >= 9.0.x.x < ESXi-9.0.2.0100-25595025`
- `ESX >= 8.0 < ESXi80U3j-25429389`
- `telco_cloud_platform 5.1.x`
- `telco_cloud_platform 5.0.x`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.