CVE-2026-41709

Think of this like a security camera system that quietly fails to record certain actions taken by someone who already has the master key to your building. They can't get in any faster because of this flaw, but once inside, some of what they do leaves no trace. For a business, that means if an administrator account is misused, you may not be able to see what really happened.

This matters to you if you run VMware ESX, ESXi, vSphere Foundation, Cloud Foundation, or Telco Cloud Platform in your infrastructure. It only comes into play if an attacker has already obtained administrator-level access to the system — it does not let someone break in on its own, but it can hide what a compromised or malicious admin account does afterward.

Attackers are already exploiting this in real-world environments, as confirmed by its listing in CISA's Known Exploited Vulnerabilities catalog, so this is a confirmed active threat rather than a theoretical risk. CISA has set a remediation deadline of November 11, 2026. While the flaw itself doesn't grant new access, it's being used to mask malicious activity during attacks, so patching should not be delayed.

1. Inventory all ESX/ESXi hosts, vSphere Foundation, Cloud Foundation, and Telco Cloud Platform deployments and identify current build numbers.
2. Target fixed builds per branch: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 (esxi package version 9.0.2.0100), or ESXi80U3j-25429389; Cloud Foundation customers should upgrade to 5.2.4. Confirm the correct branch/upgrade path via Broadcom's advisory before applying.
3. There is no effective workaround since the issue is a logging gap exploited by already-privileged accounts — mitigation is to tighten administrator account controls (reduce standing admin access, enforce MFA, use just-in-time privilege elevation) until patched.
4. CISA requires remediation by November 11, 2026 under BOD 26-04 for applicable organizations; cloud-hosted instances should follow the cloud-service guidance in that directive or be decommissioned if unpatched.
5. After patching, audit administrator activity logs for the period prior to the fix for any gaps or anomalies, and monitor post-patch logs to confirm full logging coverage is restored.

CVSS 3.1 score 2.7 (Low): AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N — network-reachable but requires high privileges (administrator), no user interaction, limited integrity impact only (logging gap), no confidentiality or availability loss. Weakness class is CWE-778 (Insufficient Logging). No public exploit code/PoC is on record, but CISA KEV confirms real-world exploitation, added 2026-10-28 with a remediation due date of 2026-11-11. Given confirmed in-the-wild exploitation, EPSS prediction is superseded and not the relevant risk signal here.