Zero Radar
← feed
CriticalVulnerabilityCVE-2026-41709updated 29 Oct 2026, 08:03 UTC

VMware ESX admin actions can go unlogged

A person who already has administrator access to VMware ESX servers can do things that leave no record in the logs. That makes it harder to notice or investigate an intrusion.

Exploited (CISA KEV, NVD)Official, 6 sources
SeverityCriticalCVSS 2.7 of 10
Being exploited?YesConfirmed by CISA KEV, NVD · 28 Oct 2026
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 6 sourcesBacked by an official source

How the attack works simplified

  1. 1Admin access gainedAttacker holds administrator rights on ESX
  2. 2Hidden operationsCertain actions run without being logged
  3. 3Audit trail gapsInvestigators lack records of the activity
  4. ResultIntrusion goes undetected in logs

What happened

CVE-2026-41709 is an insufficient logging flaw in Broadcom VMware ESX. A malicious administrator can perform certain operations without them being logged.

Why it is dangerous: Attackers can hide their activity on virtualization hosts, weakening audit trails and forensic investigations. Organizations running ESX with exposed or shared admin access are most at risk, and the flaw is confirmed as exploited by a China-linked group targeting the U.S. legal sector.

Are you affected?

You are affected if you run Broadcom VMware ESX hosts with administrative access that could be misused or compromised.

Broadcom VMware ESX (specific versions not stated in the provided material)

What to do

  1. Apply the vendor mitigations or patches from Broadcom for VMware ESX
  2. Review who holds administrative access to ESX hosts and remove unnecessary accounts
  3. Check ESX logs and other sources for signs of compromise, following CISA's forensics triage guidance
  4. If no mitigation is available, consider discontinuing use of the affected product per CISA guidance

Timeline

  1. 30 Jul 2026, 14:16 UTC
    Publicly disclosed
  2. 28 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 28 Oct 2026, 19:47 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:57 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 20:27 UTC
    NVD reported on it · NVD
  6. 28 Oct 2026, 20:32 UTC
    CISA reported on it · CISA
  7. 29 Oct 2026, 06:54 UTC
    The Hacker News reported on it · The Hacker News
  8. 29 Oct 2026, 08:03 UTC
    SecurityWeek reported on it · SecurityWeek

Sources 6 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-41709 · GHSA-vpqj-56x2-gp9p
CVSS
2.7 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
30 Jul 2026, 14:16 UTC
On Zero Radar
28 Oct 2026, 19:47 UTC (90 days after disclosure)
Last change
29 Oct 2026, 08:03 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

VMware ESX admin actions can go unlogged · Zero Radar