CVE-2026-41709 — Broadcom VMware ESX insufficient logging vulnerability

60/100

CVE-2026-41709 allows an administrator to perform operations without being logged in VMware ESX. It has been added to the CISA KEV.

• Actively exploited (CISA KEV, added 2026-10-28)
• CVSS 2.7
• EPSS 0.3 %
• Broadcom
• CWE-778

Digest of 2026-10-29

Sources

• The Hacker News — China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
• CISA — Cybersecurity advisories — CISA Adds Two Known Exploited Vulnerabilities to Catalog
• CISA — Known Exploited Vulnerabilities — CISA KEV — Broadcom VMWare ESX Insufficient Logging Vulnerability (CVE-2026-41709)