CISA KEV catalog addition October 28, 2026; CyberPress report October 29, 2026
A 2.7 Flaw Earns a KEV Listing: The VMware ESX Logging Gap Lets an Admin Act Without a Record
CISA added CVE-2026-41709, an insufficient logging flaw in Broadcom VMware ESX, to its Known Exploited Vulnerabilities catalog on October 28 and set a remediation deadline of November 11, 2026 for federal agencies. The score is low, 2.7 under CVSS 3.1, and the shape is narrow: Broadcom, which published the flaw on July 30, describes a condition in which a malicious actor who already holds administrator privileges can execute certain operations without those operations being recorded (CWE-778, insufficient logging). The assessed impact is to integrity only, with no direct confidentiality or availability effect, and the record does not say which specific operations evade logging. The operational weight comes from who uses such a gap: an intruder holding stolen ESXi administrator credentials, or a malicious insider, gains room to change a virtualization estate while the local record stays incomplete, which complicates reconstructing what happened afterward. Affected branches span ESX 8.0, 9.0, and 9.1, with fixed builds including ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, and ESXi-9.1.0.0-25370933; VMware Cloud Foundation 5.x before 5.2.4, Cloud Foundation 9.0 and 9.1, vSphere Foundation 9.0 and 9.1, and Telco Cloud Platform 5.0 and 5.1 are also listed. Broadcom lists no workaround. CISA marks mandatory forensic triage as not required for this entry and ransomware campaign use as unknown.
Executives
Severity scores measure how a flaw works, not how it will be used. A low score on a flaw that erases the record of admin actions is a governance problem: after an incident, the logs are how you prove what did and did not happen. Ask whether your hypervisor logs leave the host in real time, because a copy the host cannot reach is the control that survives this flaw.
CIO / CISO
Patch to the fixed builds in Broadcom advisory 38017 by November 11 even though the score is 2.7, and pair the patch with an access review: who holds ESXi and vCenter administrator rights, and are any of those accounts shared, dormant, or exempt from multifactor authentication. KEV listing means CISA holds evidence of exploitation in the wild, so treat unexplained gaps in ESX logs from the past quarter as a finding to explain, not a curiosity.
Engineers
Match each host against the Broadcom response matrix rather than assuming a product name settles the build, because Cloud Foundation, vSphere Foundation, and Telco Cloud Platform lines are affected alongside ESX itself. There is no workaround, so scheduling the update is the mitigation. Confirm host logs forward to a separate log server, and check that forwarding works after the update, not just before it.
Everyone (non-IT)
If you administer virtual machines at work, nothing changes about your daily routine. The point of this story is simpler: the record of who changed what is itself a security control, and this flaw is a reminder to keep that record somewhere an intruder cannot reach.