CISA Adds Actively Exploited VMware ESXi Logging Flaw to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41709, a vulnerability related to insufficient logging affecting Broadcom VMware ESX, to its Known Exploited Vulnerabilities (KEV) catalog.

This decision was made after evidence of exploitation in the wild was discovered. The announcement, made on October 28, 2026, raised the priority of addressing this flaw, despite its low severity rating.

The catalog entry establishes a remediation deadline of November 11, 2026. It also notes that the vulnerability’s involvement in ransomware campaigns is currently unknown, and forensic triage is not required under Binding Operational Directive (BOD) 26-04.

VMware ESXi Logging Flaw

Published on July 30, 2026, the vulnerability lets a malicious actor with administrative privileges perform certain operations without logging them. The CVE record assigns a CVSS v3.1 score of 2.7 and classifies the weakness as CWE-778, Insufficient Logging.

The distinction is important: this vulnerability does not itself provide initial access or administrator privileges. Instead, an attacker with administrative access could exploit the logging gap to reduce visibility into subsequent activity. Its CVSS vector specifies high privileges, low attack complexity, and no required user interaction.

MITRE explains that insufficient logging can conceal security events and hinder forensic analysis. Consequently, missing records could complicate efforts to reconstruct an intrusion, identify unauthorized changes, or establish an attacker’s operational timeline.

Previous reporting on VMware ESXi exploitation in ransomware operations illustrates the broader threat to virtualization infrastructure. However, that separate vulnerability should not be confused with this logging flaw, whose ransomware association remains unconfirmed.

The CVE record identifies affected ESX releases across the 8.0, 9.0, and 9.1 branches. It lists fixed build thresholds as ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, and ESXi-9.1.0.0-25370933, respectively. Affected product listings also include VMware Cloud Foundation, vSphere Foundation, and Telco Cloud Platform.

CISA’s supplied remediation instructions require organizations to apply vendor mitigations while following applicable BOD 26-04 risk prioritization and forensic triage guidance. Stakeholders must evaluate each asset’s internet exposure, follow applicable cloud service guidance, and discontinue affected products if mitigations are unavailable.

Administrators should validate their deployed builds against vendor instructions rather than treating the low CVSS score as evidence that remediation can wait.

For defenders, the concern is accountability: compromised administrative access becomes harder to investigate when operations leave incomplete audit trails.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.