Broadcom VMWare ESX Insufficient Logging Vulnerability (CVE-2026-41709) is being actively exploited, CISA warns
CISA added CVE-2026-41709 (Broadcom VMware ESX) to its Known Exploited Vulnerabilities catalog on October 28, 2026, which means there is reliable evidence of exploitation in the wild. Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Excerpt from the primary source: CISA Known Exploited Vulnerabilities
Who is affected
Enterprises
Affected technology: VMware ESX, vSphere / ESXi / vCenter
Why it matters
CISA lists this as exploited in the wild. Unpatched vSphere / ESXi / vCenter and VMware ESX systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Patch
Apply the vendor's security update for vSphere / ESXi / vCenter and VMware ESX. Check the linked advisory for affected and fixed versions, and put internet-facing systems first.
CISA's required action for CVE-2026-41709: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." US federal civilian agencies must comply by November 11, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
InfraTrust report warns of exploited flaws in critical network infrastructure
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk.
Even after PHP2Shell, blast radius matters more than a CVSS score
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach.
Apply the vendor's security update for the affected products.
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.
TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.