← All CVEs

CVE-2026-41709

low · 2.7Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Added 2026-10-28Remediation due 2026-11-11

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

2.7
CVSS
0.7%
EPSS (exploit prob.)
53rd
EPSS percentile
2026-07-30
Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-778

Affected products

VendorProductAffected versions
vmwareesxi>= 9.0.0, < 9.0.2.0100
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwareesxi8.0
vmwarecloud_foundation>= 5.0, < 5.2.4
vmwaretelco_cloud_platform>= 5.0, < 5.2
vmwarevsphere_foundationall versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-41709