CVE-2026-41709: vmware esxi

CVSS 2.7 (low) · listed as exploited by CISA since 2026-10-28 · published 2026-07-30

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Affected products (NVD): vmware esxi

Fixed in (NVD): 9.0.2.0100

Weakness: CWE-778

Source: NVD CVE-2026-41709

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.