What’s Vulnerable › Vulnerabilities
CVE-2026-41709: ESX insufficient logging vulnerability
- Severity: low (CVSS 2.7 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-10-28
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-30 · updated 2026-10-29
- Weakness: CWE-778
Description
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Summary
VMware ESX contains an insufficient logging flaw that lets a malicious administrator perform certain operations without them being recorded, weakening audit trails and forensic visibility; CVSS is 2.7 (low). Affected products include VMware Cloud Foundation (fixed in 5.2.4), VMware ESX (fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389), VMware Telco Cloud Platform, and VMware vSphere Foundation. CISA lists it in the Known Exploited Vulnerabilities catalog with active exploitation, so apply the vendor fixes or mitigations per CISA BOD 26-04 guidance, and discontinue use if mitigations are unavailable.
تحتوي VMware ESX على ثغرة تسجيل غير كافٍ تتيح لمسؤول خبيث تنفيذ عمليات معينة دون تسجيلها، مما يضعف مسارات التدقيق والرؤية الجنائية، ودرجة CVSS هي 2.7 (منخفضة). تشمل المنتجات المتأثرة VMware Cloud Foundation (تم إصلاحها في 5.2.4) وVMware ESX (تم إصلاحها في ESXi-9.1.0.0-25370933 وESXi-9.0.2.0100-25595025 وESXi80U3j-25429389) وVMware Telco Cloud Platform وVMware vSphere Foundation. تُدرجها CISA في كتالوج الثغرات المعروفة المستغلة مع استغلال نشط، لذا طبّق إصلاحات المورّد أو التخفيفات وفق إرشادات CISA BOD 26-04، وأوقف استخدام المنتج إذا لم تتوفر التخفيفات.
Affected products
- VMware ESXi: from 9.0.0 before 9.0.2.0100; 8.0-a, 8.0-b, 8.0-c, 8.0-d, 8.0-e, 8.0-f (+20); 8.0 — fixed in 9.0.2.0100
- VMware Cloud Foundation: from 5.x before 5.2.4; 9.1.x.x, 9.0.x.x — fixed in 5.2.4
- VMware ESX: from 9.1.x.x before ESXi-9.1.0.0-25370933; from 9.0.x.x before ESXi-9.0.2.0100-25595025; from 8.0 before ESXi80U3j-25429389 — fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389
- VMware Telco Cloud Platform: 5.1.x, 5.0.x
- VMware vSphere Foundation: 9.1.x.x, 9.0.x.x
How to fix
Upgrade to a fixed version: VMware ESXi 9.0.2.0100; VMware Cloud Foundation 5.2.4; VMware ESX ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389. Check the vendor advisory for mitigations.
In the news
- Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
- Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
- China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
References
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709
Get alerted when CVE-2026-41709 or the next vulnerability affects your stack