VMware ESX CVE-2026-41709 in CISA KEV: A 2.7 Flaw That Hides an Admin's Tracks

CVE-2026-41709 was published on July 30, 2026 with a score of 2.7. LOW. The kind of CVE nobody reads to the end.

On October 28, three months later, CISA added it to the KEV catalog with a deadline of November 11. So a 2.7 is being exploited in the wild. The reason is right there in the description: it lets an administrator act on the hypervisor without those operations being logged.

The Vulnerability

NVD description:

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

The description doesn't say which operations slip past logging. Broadcom's advisory, listed in the references, is the only source for that.

Why a 2.7 Ends Up in KEV

By CVSS logic, the low score is earned:

• PR:H — you already need to be an administrator;
• C:N/A:N — no data exposed, nothing taken down;
• I:L — the only impact is on the integrity of the logs.

But CVSS measures what a flaw opens, not what it hides. A logging flaw isn't a way in. It's for people who are already inside.

Neither NVD nor CISA describe the campaign. The flaw's profile, though, fits a post-compromise step — an inference, not a published fact: an attacker gets admin rights on the hypervisor (stolen credentials, another bug, a foothold in vCenter), then uses CVE-2026-41709 so their actions on the host never show up in the logs. On an ESX host, those actions can reach every hosted virtual machine.

It's the same pattern as other "admin required" flaws that reach KEV months after publication: the score buries them in the backlog, and attackers use them to stay.

VMware hypervisors are a recurring ransomware target, as covered in our overview of exploited vCenter and ESXi CVEs. Here, the KEV entry's ransomware field reads "Unknown": CISA hasn't confirmed ransomware use.

Affected Versions

NVD's CPE configuration covers two branches:

⚠️ For 8.0, NVD lists vulnerable builds one by one but gives no fixed version. The 9.0.2.0100 figure is also an NVD bound, not necessarily the build to install. Either way, the reference is Broadcom's advisory (ID 38017 on the Broadcom support portal).

The 7.0 branch doesn't appear in NVD's configuration.

Check a host's version:

esxcli system version get

Detection

The catch is obvious: the flaw targets the logs themselves. A few angles remain:

• Compare host state (VMs, virtual networks, local accounts, services such as SSH) against an earlier inventory or configuration backup: a change with no log trail is a signal
• Cross-check host logs against vCenter and remote syslog: an action visible on one side and missing on the other needs explaining
• Local admin accounts on ESX hosts: list them and look for any that don't map to a person or a service
• Direct admin logins to hosts, bypassing vCenter, from unusual addresses

esxcli system account list
esxcli system syslog config get

Mitigation

1. Apply Broadcom's fix

The CISA deadline is November 11. For ESXi 8.0, take the target build from Broadcom's advisory — NVD doesn't give one.

2. Deal with admin access

The flaw needs an admin account, so that's where the real defence is.

• Cut down the number of accounts with admin rights on hosts and on vCenter
• Disable SSH and the ESXi Shell when they're not in use
• Keep host management interfaces on an isolated admin network
• Turn on lockdown mode to force management through vCenter

3. Get logs off the host

Shipping logs to remote syslog or a SIEM doesn't fix the flaw, but it keeps a copy of whatever was logged out of a host admin's reach.

4. If you suspect compromise

Patching restores logging going forward, not retroactively. The KEV entry points to the forensic triage requirements of BOD 26-04: check host and VM integrity, rotate admin credentials and vCenter integration secrets.

Why Continuous Monitoring of Your Hypervisors Matters

A LOW published in July sets off no alarms. Its KEV listing in October should set one off right away — provided you know which ESX build runs on each host.

With cveo.tech, inventory your VMware hosts with exact versions and get alerted whenever a CVE affecting them enters the CISA KEV catalog, whatever its score.