VMware ESX logging flaw CVE-2026-41709 exploited: admin actions can go unlogged

What happened

Broadcom VMware ESX contains an insufficient logging vulnerability, tracked as CVE-2026-41709. A malicious actor who already has admin access to the host can perform certain operations without them being logged. The vulnerability has been public since July 30, 2026, and Broadcom has published a security advisory.

This is not a new vulnerability. What is new is that CISA added it to its catalog of known exploited vulnerabilities on October 28, 2026, which confirms active attacks. The CVSS base score is only 2.7, because the flaw requires admin access. In practice, it helps attackers who have already compromised a host to hide what they do on it. Hosts that have not been patched since the July disclosure are at risk.

Who is affected

Anyone running Broadcom VMware ESX hosts that have not received the fix from Broadcom's advisory. The source data does not list the affected or fixed versions. Check the Broadcom security advisory linked below for the exact builds.

The risk is highest for hosts whose management interfaces are reachable from the internet or from less trusted networks, and for environments where admin credentials are shared or may already have been exposed.

What to do now

1. Open the Broadcom security advisory linked below and note the fixed builds or mitigations for your ESX versions.
2. Back up the host configuration before patching, for example with vim-cmd hostsvc/firmware/backup_config on ESXi.
3. Migrate or shut down the virtual machines, put the host into maintenance mode, apply the patch and reboot the host.
4. Confirm after the reboot that the host reports the fixed build, leave maintenance mode and check that the virtual machines start and run normally.
5. If no patch is available for your version, apply the mitigations described by Broadcom. CISA advises discontinuing use of the product if no mitigations are available.
6. Review all accounts with admin rights on the host and in vCenter. Remove accounts that are not needed and rotate the root and admin passwords, especially if a host was reachable from the internet.
7. Restrict access to the management interfaces (web client, SSH, API) to trusted admin networks and disable SSH and the ESXi shell where they are not needed.
8. Forward host logs to a remote syslog server so that records survive on a system the attacker does not control.

How to check whether you are affected

• Check the build of each host with esxcli system version get or vmware -vl and compare it with the fixed builds in the Broadcom advisory.
• Check whether remote logging is configured with esxcli system syslog config get.
• Review /var/log/auth.log, /var/log/shell.log and /var/log/hostd.log, as well as vCenter events, for unexpected logins, new accounts, enabled SSH or changed configuration. Keep in mind that this vulnerability allows certain operations to leave no log entries, so missing entries do not prove that a host is clean.
• Compare the current host configuration, users, firewall rules and installed VIBs (esxcli software vib list) with a known good state.
• If you find signs of compromise, isolate the host, preserve logs and data before making changes, and follow CISA's Forensics Triage Requirements referenced in the CISA catalog entry.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-41709
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog