Priority alerts and briefings from Radar, by email.
Checking availability…
Security advisory
VMware ESX: an administrator can hide operations from logs
CISA added the ESX logging flaw to KEV on October 28. A malicious administrator can perform certain operations without a log entry; update affected hosts and review privileged activity using additional evidence.
Who should check: Teams operating VMware ESX hosts and the platforms that manage them.
Recommended actionFix available
Install the ESX correction for the deployed branch and platform. Review administrative access and available external telemetry; missing host log entries do not rule out malicious activity.
Broadcom describes insufficient logging in VMware ESX: an administrator can perform certain operations without those operations being recorded. Its CVSS 3.1 score is 2.7. The critical severity at the top of the multi-CVE bulletin belongs to the bulletin as a whole and must not be assigned to this CVE.
CISA added this exact CVE to KEV on October 28, 2026. This changes the exploitation evidence, not the privilege requirement. It is not an unauthenticated RCE.
The fixed builds below come from section 3e. Use the supported upgrade procedure for the deployed platform; the listed versions are vendor guidance, not a verification of customer download access. Telco Cloud Platform 5.0.x and 5.1.x use the vendor procedure linked in that matrix.
Oktsec recommends examining privileged access and independent telemetry when assessing possible abuse. Updating cannot recover missing historical log entries. July 29 is the original advisory date; October 28 is the KEV addition date, not the start of attacks.
Vendor / publisher
Broadcom
Vulnerability identifiers
CVE-2026-41709
Access required
Account access required
Vendor severity
2.7 · CVSS 3.1
Disclosed
Jul 29, 2026
Latest evidence check
Oct 28, 2026 UTC
Which systems and versions are affected?
Product
Affected
Fixed release / action
VMware ESX 9.1.x.x
Builds without the section 3e correction
ESXi-9.1.0.0-25370933
VMware ESX 9.0.x.x
Builds without the section 3e correction
ESXi-9.0.2.0100-25595025
VMware ESX 8.0
Builds without the section 3e correction
ESXi80U3j-25429389
VMware Cloud Foundation 5.x
Platform installations without the section 3e correction
5.2.4; follow the platform-specific patch procedure
Use the guidance for your product and release branch. Confirm distribution backports with the vendor; the product name alone does not establish exposure.
KEV confirms exploitation of this exact logging CVE. Broadcom requires a malicious administrator; it does not describe remote unauthenticated code execution. Prioritize affected hosts and review privileged activity.
What does this mean for AI environments?
Oktsec recommends checking workloads and credentials reachable from affected virtualization hosts, including agent infrastructure where deployed.
Added advisory coverage with product-specific response steps and dated exploitation evidence.
Response actions
Plan your response
0 of 4 actions recorded as done
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
1
Match the host and platform branch
Inventory ESX builds, management access and platform dependencies. Use section 3e of the advisory, not the matrices for other CVEs in the same bulletin.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
2
Apply the supported platform update
Install the listed correction or a later supported release containing it. Telco Cloud deployments require the separate vendor procedure. Broadcom lists no workaround.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
3
Review administrative activity
Oktsec recommends reviewing identity, management and external telemetry in addition to host logs. The vulnerability can omit certain operations from logging; an empty log is not evidence that no activity occurred.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
4
Verify the installed build and logging
Record the running build and maintenance result, then test expected audit collection. Patching does not reconstruct previously omitted log events.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
3. Share the plan
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Compare the running version and configuration with the vendor guidance.
Product
Affected
Fixed release / action
VMware ESX 9.1.x.x
Builds without the section 3e correction
ESXi-9.1.0.0-25370933
VMware ESX 9.0.x.x
Builds without the section 3e correction
ESXi-9.0.2.0100-25595025
VMware ESX 8.0
Builds without the section 3e correction
ESXi80U3j-25429389
VMware Cloud Foundation 5.x
Platform installations without the section 3e correction
5.2.4; follow the platform-specific patch procedure
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Access requiredAccount access required
TRACEABLE EVIDENCE
Evidence & sources
Checked Oct 28, 2026 UTC
Why this priority
KEV confirms exploitation of this exact logging CVE. Broadcom requires a malicious administrator; it does not describe remote unauthenticated code execution. Prioritize affected hosts and review privileged activity.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA’s federal deadlines and requirements are shown for context. They are not a universal deadline for private organizations or businesses in Latin America. The date added is the catalog inclusion date, not the first attack date.
Priority applies to the parent advisory, not separately to every product or CVE. Each row shows only the evidence attributed to that CVE. Missing attack evidence does not mean a vulnerability is safe to ignore. Your environment has not been scanned.
Sources
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.