CVE-2026-41709

{"id": "CVE-2026-41709", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41709", "role": "CISA Coordinator", "options": [{"exploitation": "active"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "VMware", "product": "Cloud Foundation", "versions": [{"status": "affected", "version": "9.1.x.x"}, {"status": "affected", "version": "9.0.x.x"}, {"status": "affected", "version": "5.x", "lessThan": "5.2.4", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "vSphere Foundation", "versions": [{"status": "affected", "version": "9.1.x.x"}, {"status": "affected", "version": "9.0.x.x"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "ESX", "versions": [{"status": "affected", "version": "9.1.x.x", "lessThan": "ESXi-9.1.0.0-25370933", "versionType": "custom"}, {"status": "affected", "version": "9.0.x.x", "lessThan": "ESXi-9.0.2.0100-25595025", "versionType": "custom"}, {"status": "affected", "version": "8.0", "lessThan": "ESXi80U3j-25429389", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Telco Cloud Platform", "versions": [{"status": "affected", "version": "5.1.x"}, {"status": "affected", "version": "5.0.x"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T14:16:57.420", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709", "tags": ["US Government Resource"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-778"}]}], "descriptions": [{"lang": "en", "value": "VMware ESX contains an insufficient logging vulnerability.\u00a0A malicious administrator could exploit this issue to perform certain operations without them being logged."}], "lastModified": "2026-10-29T17:29:11.590", "cisaActionDue": "2026-11-11", "cisaExploitAdd": "2026-10-28", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7DC2815-CD13-42DC-96E5-412CFB768A6A", "versionEndExcluding": "9.0.2.0100", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A1A402A-9262-4B97-A0B7-E5AE045E394D"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE44B379-9943-4DD1-8514-26F87482AFA8"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A797377-8945-4D75-AA68-A768855E5842"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79D84D76-54BE-49E9-905C-7D65B4B42D68"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:d:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3BC5C77-258A-4920-B217-396212056B14"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:e:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17D484EB-037C-46E2-ADDF-846B3A02843F"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:f:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E689385-7521-4A7A-B81E-DD84A3B58238"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:g:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69E59579-57D6-40BA-98FA-28D3C41BA222"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F8767F7-7C3D-457D-9EAC-E8A30796F751"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29AF8474-2D7A-4C5A-82B9-7A873AD90C2E"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7781A2CA-D927-48CD-9932-AE42B7BA1EFE"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18FD08C9-5895-4BF4-BBE0-C2DDA5F6B836"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "360C1B71-5360-4379-B0DE-63BB8F5E6DA2"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B16ED7C1-9881-452A-8BE0-EDDEAEFE3D7B"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED92209F-FBD6-43F9-9A15-3842B139FCC9"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2d:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C37C4F29-E18F-439B-83A2-16457D04BEE1"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2e:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "934CDD6F-E611-4693-AD30-12F35E10A75C"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_2f:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E33AE07-0F0F-4030-B62A-65DD086648D1"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B701151-1B57-4E2D-A9AB-586FACEA2385"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4230B9AA-9E0C-4AE2-814D-8DD641394879"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2FA150B-93E4-44D2-BF6D-347085A95776"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3d:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12356603-13A5-4CC7-813A-7FF3DFC21A95"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3e:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0EBA616-FA2A-4A2D-918E-2D32579DA1F3"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3f:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B275C1D0-9CFF-46DF-9630-1DD7CA060A6A"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3g:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D47EDD24-7244-471B-8752-37AA7BAA38DC"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3h:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEA3431E-7C96-435E-8771-C76386374568"}, {"criteria": "cpe:2.3:o:vmware:esxi:8.0:update_3i:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4802C03A-C3BC-4295-BE05-6E569E9FEB8A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E1B59BCD-58B0-4E47-8990-80B03443DB1C", "versionEndExcluding": "5.2.4", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "97FFC2CA-34F4-4822-93F1-0D645075462B", "versionEndExcluding": "5.2", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "03AD0AB7-45A3-4DC7-923D-1166346EEA12"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@vmware.com", "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "cisaVulnerabilityName": "Broadcom VMWare ESX Insufficient Logging Vulnerability"}