Skip to main content
Apexward Pulse

Broadcom

Broadcom VMWare ESX Insufficient Logging Vulnerability

CVE-2026-41709

What this means

This is rated low severity (2.7 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Vmware Esxi, Vmware Cloud Foundation and Vmware Telco Cloud Platform, and 1 more are in your estate.

Full vendor description

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Scoring and exploitation

2.7/ 10
CVSS 3.1 base scoreLow

Exploitable over the network with an administrator-level account, and no one has to click or open anything. Low impact on integrity.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredHighPR:H
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityNoneC:N
IntegrityLowI:L
AvailabilityNoneA:N
~0.7% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Broadcom VMware ESX

Weaknesses

CWE-778

Affected products ()

  • Vmware Esxi
  • Vmware Cloud Foundation
  • Vmware Telco Cloud Platform
  • Vmware Vsphere Foundation
Show the raw CPE strings (31)
  • cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:d:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:e:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:f:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:g:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2d:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2e:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2f:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3d:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3e:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3f:*:*:*:*:*:*

Showing 25 of 31 matches from .

References

2 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • Broadcom VMWare ESX Insufficient Logging Vulnerability

    Type Vulnerability

    CISA has added two new vulnerabilities to its known-exploited catalogue, based on evidence of active exploitation.

    Next step: Confirm whether VMware Telco Cloud Platform is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 2Vendor statement missing. no VendorResearcher coverage missing. no Researcher2 signals

    Only official coverage so far. Treat as an early signal.

    VMware Telco Cloud PlatformVMware Vsphere FoundationVMware Cloud Foundation+2 more
    CVE-2026-41709+1