Skip to content
Log inStart free trial

CVE-2026-41709

VMware ESX contains an insufficient logging vulnerability.

Low Known exploited
Severity
2.7 / 10
Low · CVSS 3.1
Exploit chance (EPSS)
0.69%
Chance of exploitation in the next 30 days. Higher than 52.76% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Oct 28, 2026
Weakness
CWE-778 Insufficient Logging
Fix
None yet
No fixed version published
Exploited in the wild. Broadcom VMWare ESX Insufficient Logging Vulnerability (Broadcom VMware ESX). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Nov 11, 2026.

Description

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 2.7

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Weakness

CWE-778: Insufficient Logging

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

How to prevent it
  • Architecture and Design: Use a centralized logging mechanism that supports multiple levels of detail.
  • Implementation: Ensure that all security-related successes and failures can be logged. When storing data in the cloud (e.g., AWS S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to enable and capture detailed logging information.
  • Operation: Be sure to set the level of logging appropriately in a production environment. Sufficient data should be logged to enable system administrators to detect attacks, diagnose errors, and recover from attacks. At the same time, logging too much data (CWE-779) can cause the same problems, including unexpected costs when using a cloud environment.
  • Operation: To enable storage logging using Azure's Portal, navigate to the name of the Storage Account, locate Monitoring (CLASSIC) section, and select Diagnostic settings (classic). For each of the various properties (blob, file, table, queue), ensure the status is properly set for the desired logging data. If using PowerShell, the Set-AzStorageServiceLoggingProperty command could be called using appropriate -ServiceType, -LoggingOperations, and -RetentionDays arguments.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Last updated by the source
  4. Latest EPSS score
  5. Remediation due for U.S. federal agencies
AdvisorySeverityWhy it's related
GHSA-439w-v2p7-pggc
Juju has unauthorized access to out-of-scope Kubernetes secrets
High Same weakness, CWE-778
GHSA-fp5m-4mqh-849p
Magento 2 Community Edition Insufficient Logging
Medium Same weakness, CWE-778
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor