🔥 On the fly · exploited in the wildKEV due in 13dAmericano · 183°ClowHalf-poured · some lines fixed
Broadcom VMWare ESX Insufficient Logging Vulnerability
VMware Cloud Foundation
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. Added to CISA KEV on 2026-10-28 (federal deadline 2026-11-11).
Upgrade to Cloud Foundation 5.2.4, ESX ESXi-9.1.0.0-25370933, ESX ESXi-9.0.2.0100-25595025, plus 1 more line in Fix it.
Cloud Foundation
- On 5.xUpgrade to Cloud Foundation 5.2.4
- On 9.xFix not named in the CVE record: see vendor advisory
- On 9.xFix not named in the CVE record: see vendor advisory
vSphere Foundation
- On 9.xFix not named in the CVE record: see vendor advisory
- On 9.xFix not named in the CVE record: see vendor advisory
ESX
- Apply ESXi-9.1.0.0-25370933
- Apply ESXi-9.0.2.0100-25595025
- Apply ESXi80U3j-25429389
Telco Cloud Platform
- On 5.xFix not named in the CVE record: see vendor advisory
- On 5.xFix not named in the CVE record: see vendor advisory
Fixed for Cloud Foundation and ESX; still cooking for vSphere Foundation and Telco Cloud Platform.
- First seen
- Last update
- Fixed in
- Cloud Foundation 5.2.4
- ESX ESXi-9.1.0.0-25370933
- ESX ESXi-9.0.2.0100-25595025
- ESX ESXi80U3j-25429389
- Identifiers
- CVSS
- 2.7
- KEV deadline
- 2026-11-11
- Source
- CISA KEV
- On the menu as
Timeline
Exploited by Chinese hackers.
Chinese hackers quietly used the low-severity ESXi logging flaw as a zero-day.
China-linked hackers exploited VMware ESX zero-day to reduce audit trail visibility.
Fix status: unknown → partial fix.
Added to CISA's Known Exploited Vulnerabilities Catalog
First reported.
Receipt
- Exploitation
- Exploited: listed in CISA KEV
- CISA KEV “CVE-2026-41709 added to CISA KEV on 2026-10-28, federal deadline 2026-11-11.” source
- Fix by release line
Product Affected Fixed in Source Cloud Foundation = 9.1.x.x fix not named in the CVE record: see vendor advisory CVE record (CNA) checked Cloud Foundation = 9.0.x.x fix not named in the CVE record: see vendor advisory CVE record (CNA) checked Cloud Foundation before 5.2.4 5.2.4 CVE record (CNA) checked vSphere Foundation = 9.1.x.x fix not named in the CVE record: see vendor advisory CVE record (CNA) checked vSphere Foundation = 9.0.x.x fix not named in the CVE record: see vendor advisory CVE record (CNA) checked ESX before ESXi-9.1.0.0-25370933 ESXi-9.1.0.0-25370933 CVE record (CNA) checked ESX before ESXi-9.0.2.0100-25595025 ESXi-9.0.2.0100-25595025 CVE record (CNA) checked ESX before ESXi80U3j-25429389 ESXi80U3j-25429389 CVE record (CNA) checked Telco Cloud Platform = 5.1.x fix not named in the CVE record: see vendor advisory CVE record (CNA) checked Telco Cloud Platform = 5.0.x fix not named in the CVE record: see vendor advisory CVE record (CNA) checked The CVE record names no fix for 6 lines; the vendor’s advisory may: support.broadcom.com
- Score
- CVSS 2.7 (low). CVSS 3.1 2.7 (CNA vmware) for CVE-2026-41709
- Last checked
Sources: KEV ✓ CVE record ✓ Vendor ✓
Sources
- NVD: CVE-2026-41709
- Advisory (support.broadcom.com)
- cisa.gov: CISA Adds Two Known Exploited Vulnerabilities to Catalog
- feeds.feedburner.com: China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
- securityweek.com: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
- securityaffairs.com: U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog
Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.
Totalone coffee