VMware ESX logging flaw CVE-2026-41709 is now exploited
CISA lists VMware ESX flaw CVE-2026-41709 as exploited. It is low severity but hides admin actions. See what to check and what we do not cover.
TL;DR: CISA has listed CVE-2026-41709, a VMware ESX logging flaw, as exploited. It is low severity and needs an administrator, but the missing logs matter for investigations. Stackurity does not cover ESX.
What happened
On October 28, 2026, CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalogue, with a due date of November 11, 2026. Broadcom's ESX has a weakness (CWE-778) that lets a malicious administrator carry out some operations without them being logged. The National Vulnerability Database shows a CVSS v3.1 score of 2.7 (low) assigned by the vendor.
The low score reflects that an attacker already needs high privileges. Its value to an attacker is cover: actions taken on a host leave no trail. No fixed version is in the data we hold, so follow the Broadcom advisory that CISA references.
Am I affected?
If you run VMware ESX hosts, yes, until you have read the Broadcom advisory. Review who holds administrator rights on those hosts and whether logs are sent to a separate system that an administrator cannot alter.
How to check with Stackurity
Stackurity does not cover VMware ESX: its documentation lists Linux server packages, repositories, container images, Kubernetes and AWS managed services, and it does not cover appliance firmware. Use Broadcom's advisory and your virtualisation tooling for this one. For the Linux guests and applications running on top, Stackurity can help: start a free trial, and see how Stackurity protects your data.
