# VMware ESX CVE-2026-41709: Patch the Logging Gap Now

> CISA added CVE-2026-41709, a 2.7-rated VMware ESX insufficient-logging flaw, to the KEV catalog on 28 October 2026, three months after Broadcom fixed it in VMSA-2026-0006. A bug that lets an admin act without leaving a log entry matters most after someone else has become that admin. This guide covers the fixed builds, why a Low CVSS score should not decide the priority, and how to make sure ESX logs leave the host.

- URL: https://firewallsync.com/posts/vmware-esx-cve-2026-41709-insufficient-logging-kev/
- Site: FirewallSync (https://firewallsync.com/)
- Topic: Security Operations
- Tags: vmware, esxi, cve-2026-41709, kev, logging, vsphere, patch management
- Published: 2026-11-01
- Author: John Marshall

## Key takeaways

- CVE-2026-41709 is an insufficient-logging flaw in VMware ESX: per Broadcom, 'a malicious administrator could exploit this issue to perform certain operations without them being logged.' Broadcom does not say which operations.
- Fixed builds per VMSA-2026-0006: ESX 8.0 ESXi80U3j-25429389; 9.0.x ESXi-9.0.2.0100-25595025; 9.1.x ESXi-9.1.0.0-25370933; VCF 5.x ESX 5.2.4; Telco Cloud Platform 5.0.x/5.1.x per KB449886. There is no workaround.
- CVSS is 2.7 (Low) because exploitation needs high privileges. CISA's KEV listing (added 28 Oct 2026, due 11 Nov 2026) and its SSVC 'Exploitation: active' value say it is being used anyway, most plausibly to hide activity after an admin account is compromised.
- Patching closes the gap going forward; it does not restore entries that were never written. Forward ESX logs to a remote syslog collector so evidence of other actions leaves the host.
- The same advisory fixed CVE-2026-59310 in vCenter, which CISA added to KEV in August. If you patched vCenter then, check that your ESX hosts were updated too.



CVE-2026-41709 is not a bug that lets anyone in. It is a bug that helps whoever is already in avoid being seen. Broadcom fixed it on 29 July 2026 and rated it Low. On 28 October 2026 CISA added it to the Known Exploited Vulnerabilities (KEV) catalog, with a federal due date of 11 November 2026.

**The short answer:** update ESX hosts to the fixed build for your branch (ESX 8.0: `ESXi80U3j-25429389`; 9.0.x: `ESXi-9.0.2.0100-25595025`; 9.1.x: `ESXi-9.1.0.0-25370933`), confirm host logs are forwarded to a remote syslog collector, and treat any host that was compromised before patching as having an incomplete audit trail.

## What the vulnerability is

Broadcom's advisory, [VMSA-2026-0006](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) (section 3e), describes it this way: "VMware ESX contains an insufficient logging vulnerability." Its known attack vector: "A malicious administrator could exploit this issue to perform certain operations without them being logged."

That is the whole public description. Broadcom does not say which operations escape logging, and the CVE record adds nothing beyond the weakness class, CWE-778 (Insufficient Logging). The advisory credits Ian Barton of CrowdStrike with reporting it. We found no public technical write-up or exploitation report as of 1 November 2026, so treat any claim about specific hidden operations with suspicion until Broadcom or the reporter publishes one.

| Field | Value | Source |
|---|---|---|
| CVSS 3.1 | 2.7 Low, `AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N` | CVE record (Broadcom CNA) |
| Weakness | CWE-778 Insufficient Logging | CVE record |
| Published | 29 July 2026 (VMSA-2026-0006); CVE record 30 July | Advisory, CVE record |
| KEV added / due | 28 October 2026 / 11 November 2026 | CISA KEV |
| Known ransomware use | Unknown | CISA KEV |
| SSVC (CISA) | Exploitation: active; Automatable: no; Technical Impact: partial | CVE record, CISA ADP |
| Workaround | None | Advisory |

## Fixed builds

From the advisory's response matrix, which matches the version ranges in the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-41709):

| Product | Affected | Fixed version |
|---|---|---|
| VMware ESX 8.0 | Earlier than the fixed build | `ESXi80U3j-25429389` |
| ESX 9.0.x (VCF / vSphere Foundation 9.0) | Earlier than the fixed build | `ESXi-9.0.2.0100-25595025` |
| ESX 9.1.x (VCF / vSphere Foundation 9.1) | Earlier than the fixed build | `ESXi-9.1.0.0-25370933` |
| VMware Cloud Foundation 5.x | Earlier than 5.2.4 | ESX 5.2.4 |
| Telco Cloud Platform 5.0.x, 5.1.x | All | See Broadcom KB449886 |

The CVE record lists ESX 9.1, 9.0 and 8.0 as affected and gives no ESX 7.0 entry for this CVE. The advisory's August update (VMSA-2026-0006.2) added ESX 7.0 patch guidance for the Critical issues in the same advisory, not for this one.

To compare a host against the table, read its build number. On the host shell, `esxcli system version get` prints the version, update and build. Match the build number, not just the update name.

## Why a Low score is the wrong signal here

CVSS scores the vulnerability in isolation. "Privileges required: high" pulls the score down, because an attacker first needs an administrator account. In an intrusion that reaches the hypervisor, the attacker may already have that account, and a way to then act without leaving entries in the host's logs makes the response team's job harder.

CISA lists vulnerabilities in KEV because of evidence of exploitation, not because of their score. Its SSVC entry for this CVE records "Exploitation: active". CISA has not published details of the activity, and Broadcom's advisory change log has no entry about exploitation. Our reading, which is interpretation and not a reported fact: this flaw is most likely being used as part of a chain, after an attacker has admin access by other means.

This is the situation [CVSS vs EPSS vs KEV](/posts/cvss-vs-epss-vs-kev-which-signal-should-decide-what-you-patch-first/) describes: a KEV listing should outrank a low base score. If you use SSVC, "active" exploitation with "partial" technical impact on a hypervisor you depend on usually lands well above routine patching; see [our SSVC deployer walkthrough](/posts/ssvc-deployer-patch-priority-model-explained-exploitation-exposure-automatable-and-human-impact/).

## The vCenter half of the same advisory

VMSA-2026-0006 also fixed CVE-2026-59310, a vCenter directory-traversal flaw in the syslog server, which CISA added to KEV on 18 August 2026. Many teams patched vCenter quickly in August. ESX host updates are a separate job, usually rolled through clusters host by host, and they are easier to leave half done. If your August change record says "VMSA-2026-0006 remediated" and only covers vCenter, your hosts may still be on vulnerable builds.

## Make the evidence leave the host

Patching stops the gap from being used from now on. It does not recover entries that were never written, and it does not protect the logs that are written from an admin who can delete them on the host. The control that helps in both cases is shipping logs off the host as they are written.

Broadcom's KB [Configuring syslog on ESXi](https://knowledge.broadcom.com/external/article/318939/configuring-syslog-on-esxi.html) notes that "by default in ESXi, these logs are placed on a local scratch volume or a ramdisk." Its commands for sending them to a remote collector:

```sh
# On the ESXi host shell (per Broadcom KB 318939). Replace the address.
# Supported loghost formats include udp://host:514, tcp://host:514 and ssl://host:1514.
esxcli system syslog config set --loghost='ssl://syslog.example.internal:1514'
esxcli system syslog reload
esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true
esxcli network firewall refresh
```

We have not run these commands on a host; they are quoted from the KB. Prefer `ssl://` where your collector supports it, set the same value through host profiles or your configuration tool so it does not drift, and alert when a host stops sending.

Broadcom's [log file reference](https://knowledge.broadcom.com/external/article/306962/location-of-esxi-log-files.html) lists the files worth prioritising on the collector:

| File | What Broadcom says it contains |
|---|---|
| `shell.log` | "ESXi Shell usage logs, including enable/disable and every command entered" |
| `auth.log` | "ESXi Shell authentication success and failure" |
| `hostd.log` | "Host management service logs, including virtual machine and host Task and Events, communication with the vSphere Client" |
| `vpxa.log` | "vCenter Server vpxa agent logs, including communication with vCenter Server and the Host Management hostd agent" |
| `syslog.log` | "Management service initialization, watchdogs, scheduled tasks and DCUI use" |
| `vobd.log` | "VMkernel Observation events" |

Because Broadcom has not said which operations escape logging, you cannot write a detection for the missing entries themselves. What you can do is cross-check sources that an ESX-local gap would not touch: vCenter tasks and events, your collector's copy of the host logs, and changes visible from outside the host (new VMs, changed datastores, powered-off guests). [Logging for incidents, not for dashboards](/posts/logging-for-incidents-not-for-dashboards/) covers how to decide what to keep and for how long.

## What to do this week

1. Inventory every ESX host and its build number; compare against the fixed-version table.
2. Patch hosts still below the fixed build. There is no workaround.
3. Confirm each host has a remote `loghost` set and that the collector has recent entries from it.
4. If a host was compromised, or admin credentials for it were exposed, before it was patched, record that its local logs may be incomplete for that period and lean on vCenter and remote copies for the investigation.
5. US federal civilian agencies: the KEV due date is 11 November 2026, with the [BOD 26-04](/posts/cisa-bod-26-04-explained-kev-deadlines-forensic-triage-and-what-private-teams-can-borrow/) requirements CISA attaches to the entry. The KEV entry's forensic triage flag is "No".

## Limits of this article

Broadcom has not published which operations go unlogged, and CISA has not published the exploitation evidence behind the KEV listing. We have not tested the vulnerability or the fix. The esxcli commands are quoted from Broadcom's knowledge base, not run by us. Check Broadcom's advisory for updates before you rely on the fixed-version table.

## Sources and verification

| Important claim | Source | Status |
|---|---|---|
| Description, CVSS 2.7, fixed versions, no workaround, CrowdStrike credit, change log | [Broadcom VMSA-2026-0006](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) (last updated 19 Aug 2026) | Verified |
| Affected version ranges, CWE-778, CISA SSVC values | [CVE-2026-41709 record](https://www.cve.org/CVERecord?id=CVE-2026-41709) (CVEProject cvelistV5, updated 29 Oct 2026) | Verified |
| KEV dates added and due, ransomware "Unknown", forensic triage "No" | [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (cisagov/kev-data, version 2026.10.30) | Verified |
| CVE-2026-59310 in KEV on 18 Aug 2026 | CISA KEV catalog | Verified |
| Syslog commands and loghost formats | [Broadcom KB 318939](https://knowledge.broadcom.com/external/article/318939/configuring-syslog-on-esxi.html) | Verified (no version range stated on the KB) |
| Log file contents | [Broadcom KB 306962](https://knowledge.broadcom.com/external/article/306962/location-of-esxi-log-files.html) | Verified |
| Exploitation used to hide post-compromise activity | Editorial interpretation | Qualified |

## Frequently asked questions

### What is CVE-2026-41709?

An insufficient-logging vulnerability (CWE-778) in VMware ESX, published by Broadcom on 29 July 2026 in VMSA-2026-0006. A user who already has administrator access can perform certain operations without them being logged. Broadcom rates it Low, CVSS 3.1 base score 2.7, and has not published which operations are affected.

### Which ESXi build fixes CVE-2026-41709?

ESX 8.0: ESXi80U3j-25429389. ESX 9.0.x: ESXi-9.0.2.0100-25595025. ESX 9.1.x: ESXi-9.1.0.0-25370933. VMware Cloud Foundation 5.x: ESX 5.2.4. Telco Cloud Platform 5.0.x and 5.1.x: follow Broadcom KB449886. The CVE record lists no affected ESX 7.0 versions for this CVE.

### Why is a CVSS 2.7 vulnerability in the CISA KEV catalog?

KEV lists vulnerabilities with evidence of exploitation, not high scores. CVSS rates the flaw in isolation, and requiring admin privileges pulls the score down. In a real intrusion the attacker often has those privileges already, and a way to act without leaving log entries is valuable to them. CISA's SSVC entry for this CVE records exploitation as active.

### Does patching CVE-2026-41709 recover missing logs?

No. The patch stops the gap from being used after it is installed. Anything done through it before then was never logged. Review other evidence for that period, such as vCenter events, remote syslog copies of other ESX logs and changes on the VMs themselves.


Image credit: Photo by [Felicia Montenegro](https://unsplash.com/photos/a-collection-of-old-rusty-padlocks-hanging-together-h_YJOfuRyD0) on Unsplash