CVE-2026-41709
LOW · 2.7 KEV EPSS 0.7%KEV-confirmed active exploitation, federal deadline, but low CVSS and admin-only access limit mass exploitation potential.
What: VMware ESX insufficient logging vulnerability allowing authenticated admins to hide operations from audit logs (CVSS 2.7, LOW).
Why it matters: KEV-listed as of 2026-10-28 with confirmed active exploitation and CISA federal deadline (2026-11-11). Requires admin access but enables post-compromise cover-up, critical for insider threat / privilege abuse scenarios. Chatter spans threat intel, government advisories, and defender alerts.
Where it's seen: CISA KEV catalog announcement, multilingual security feeds (English, Japanese, French), threat intel platforms citing IOCs, and vendor/government remediation guidance. Social signal tightly aligned with official advisory timeline.
RISK: ELEVATED — KEV-listed, admin-only but enables audit evasion post-breach; low CVSS reflects access requirement, not impact severity.
Description
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N- Attack vector
- Network
- Complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None