peter bassill · operator
$ cve CVE-2026-41709 JSON

CVE-2026-41709 KEV

2.7
LOW · CVSS 3.1 · EPSS 0.3% (pctl 22)

Patch first

On CISA KEV — known exploited in the wild, due 2026-11-11.

Description

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Scoring

CVSS2.7 (LOW, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
EPSS0.3% — more likely to be exploited than 22% of all CVEs
WeaknessCWE-778
On CISA KEVyes — remediate by 2026-11-11
Public exploitnone known
Published2026-07-30
Last modified2026-10-29

CISA KEV

NameBroadcom VMWare ESX Insufficient Logging Vulnerability
Added2026-10-28
Due2026-11-11
Vendor / productBroadcom / VMware ESX
Ransomware usenone reported

References

→ the Explorer  ·  watch your stack  ·  NVD