Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since October 28, 2026.
CVE-2026-41709
Broadcom VMWare ESX Insufficient Logging Vulnerability
Added to KEV October 28, 2026
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2026-41709
- CWE
- CWE-778
- Affected products
- VMware ESX · Broadcom VMware ESX · Broadcom
What happened
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
What it means for your business
Broadcom VMware ESX is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-41709). Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. CISA remediation due date: 2026-11-11. If you need help checking exposure, call (864) 335-9223.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: November 11, 2026
Sources
Related briefs
Broadcom VMware vCenter Path Traversal Vulnerability
Broadcom VMware vCenter is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-59310). Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. CISA remediation due date: 2026-08-21. If you need help checking exposure, call (864) 335-9223.
Broadcom VMware Aria Operations Command Injection Vulnerability
Broadcom VMware Aria Operations is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-22719). Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration. CISA remediation due date: 2026-03-24. If you need help checking exposure, call (864) 335-9223.
Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
Broadcom VMware vCenter Server is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2024-37079). Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution. CISA remediation due date: 2026-02-13. If you need help checking exposure, call (864) 335-9223.
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Broadcom VMware Aria Operations and VMware Tools is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2025-41244). Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. CISA remediation due date: 2025-11-20. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.