CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging

What is CVE-2026-41709?

CVE-2026-41709 is a low-severity vulnerability in Vmware Esxi, published on 30 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Weakness: CWE-778

Which versions are affected by CVE-2026-41709?

It affects 1 product.

Products include Vmware Esxi.

How do I fix CVE-2026-41709?

No fix has been published for CVE-2026-41709 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 11 Nov 2026.

Is CVE-2026-41709 being exploited?

Yes. Attackers have exploited CVE-2026-41709 in the wild since at least 28 Oct 2026.

Other vulnerabilities in Vmware Esxi

• CVE-2019-5521 Information disclosure in VMware ESXi Critical 9.6
• CVE-2024-22252 Use-after-free vulnerability Critical 9.3
• CVE-2020-3955 Cross-site scripting in ESXi Critical 9.3
• CVE-2010-4573 Auth bypass in n/a Critical 9.3
• CVE-2019-5527 Use after free in ESXi, Workstation, Fusion, VMRC and Horizon Client High 8.8

All Vmware Esxi vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vpqj-56x2-gp9p.