# VMware ESX: an administrator can hide operations from logs Canonical: https://www.oktsec.com/radar/vmware-esx-cve-2026-41709 Publisher: Oktsec Language: en Published: 2026-10-28T23:52:08Z Updated: 2026-10-28T23:52:08Z Record reviewed: 2026-10-28T23:52:08Z Latest evidence check: 2026-10-28T23:52:08Z Disclosed: 2026-07-29 CISA added the ESX logging flaw to KEV on October 28. A malicious administrator can perform certain operations without a log entry; update affected hosts and review privileged activity using additional evidence. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: KEV confirms exploitation of this exact logging CVE. Broadcom requires a malicious administrator; it does not describe remote unauthenticated code execution. Prioritize affected hosts and review privileged activity. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Account access required - Vendor: Broadcom - Products: VMware ESX - CVEs: CVE-2026-41709 - Vendor severity: CVSS 3.1 2.7 ## Technical overview Broadcom describes insufficient logging in VMware ESX: an administrator can perform certain operations without those operations being recorded. Its CVSS 3.1 score is 2.7. The critical severity at the top of the multi-CVE bulletin belongs to the bulletin as a whole and must not be assigned to this CVE. CISA added this exact CVE to KEV on October 28, 2026. This changes the exploitation evidence, not the privilege requirement. It is not an unauthenticated RCE. The fixed builds below come from section 3e. Use the supported upgrade procedure for the deployed platform; the listed versions are vendor guidance, not a verification of customer download access. Telco Cloud Platform 5.0.x and 5.1.x use the vendor procedure linked in that matrix. Oktsec recommends examining privileged access and independent telemetry when assessing possible abuse. Updating cannot recover missing historical log entries. July 29 is the original advisory date; October 28 is the KEV addition date, not the start of attacks. ## Recommended response Install the ESX correction for the deployed branch and platform. Review administrative access and available external telemetry; missing host log entries do not rule out malicious activity. Relevant to: Teams operating VMware ESX hosts and the platforms that manage them. ## CVE attribution - CVE-2026-41709: Broadcom — VMware ESX; CVSS 3.1: 2.7. [Source](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) ## Affected systems and fixes ### VMware ESX 9.1.x.x Affected: Builds without the section 3e correction Fixed release / action: ESXi-9.1.0.0-25370933 ### VMware ESX 9.0.x.x Affected: Builds without the section 3e correction Fixed release / action: ESXi-9.0.2.0100-25595025 ### VMware ESX 8.0 Affected: Builds without the section 3e correction Fixed release / action: ESXi80U3j-25429389 ### VMware Cloud Foundation 5.x Affected: Platform installations without the section 3e correction Fixed release / action: 5.2.4; follow the platform-specific patch procedure Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.28 Checked: 2026-10-28T23:52:19.770Z ### [CVE-2026-41709](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709) - Added: 2026-10-28 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-11 - Federal forensic triage: No Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-41709 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Match the host and platform branch** — Inventory ESX builds, management access and platform dependencies. Use section 3e of the advisory, not the matrices for other CVEs in the same bulletin. 2. **Apply the supported platform update** — Install the listed correction or a later supported release containing it. Telco Cloud deployments require the separate vendor procedure. Broadcom lists no workaround. 3. **Review administrative activity** — Oktsec recommends reviewing identity, management and external telemetry in addition to host logs. The vulnerability can omit certain operations from logging; an empty log is not evidence that no activity occurred. 4. **Verify the installed build and logging** — Record the running build and maintenance result, then test expected audit collection. Patching does not reconstruct previously omitted log events. ## Relevance to AI environments Oktsec recommends checking workloads and credentials reachable from affected virtualization hosts, including agent infrastructure where deployed. ## Sources - [Broadcom VMSA-2026-0006.2, section 3e](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) — Broadcom; Vendor notice; checked 2026-10-28T23:38:45Z - [CISA KEV: CVE-2026-41709](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-10-28T23:38:45Z ## Editorial record - 2026-10-28T23:52:08Z: Added advisory coverage with product-specific response steps and dated exploitation evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/vmware-esx-cve-2026-41709) · [Build a response plan](https://www.oktsec.com/radar/vmware-esx-cve-2026-41709#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=vmware-esx-cve-2026-41709&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=vmware-esx-cve-2026-41709&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.