VMware ESX flaw CVE-2026-41709: a logging flaw now exploited, versions to install
CISA confirms exploitation of CVE-2026-41709, which lets an administrator act on ESX without leaving a trace. Fixed versions, interim measures and checks.
The short answer: CVE-2026-41709 is an insufficient logging flaw in VMware ESX, the vSphere hypervisor. A malicious administrator can perform certain operations without them appearing in the logs. Broadcom fixed it on 29 July 2026 in advisory VMSA-2026-0006 and rated it low (2.7). But on 28 October 2026, CISA added it to its KEV catalogue of actively exploited flaws. If your ESX hosts did not get this summer’s patches, now is the time.
A flaw that hides traces is not used to get in: it is used to stay quiet once inside. In an SMB, the hypervisor often carries every server (domain controller, file shares, ERP, email). An attacker acting on it without being logged has a free hand. For the broader context, see our Proxmox and Veeam virtualisation page and our guide to migrating from VMware to Proxmox.
What is affected
Advisory VMSA-2026-0006, revised on 3 and 19 August 2026, fixes five flaws. Broadcom rates it critical overall:
- CVE-2026-41709 (ESX, 2.7, low): insufficient logging, exploitable by an account with high privileges.
- CVE-2026-47876 (ESX, 9.3, critical): out-of-bounds write in the VMXNET3 virtual network adapter. A local administrator on a virtual machine can execute code on the host: a VM escape.
- CVE-2026-41703 (ESX 7.6, important; Workstation and Fusion 2.7): out-of-bounds read, leading to information disclosure or denial of service.
- CVE-2026-59309 and CVE-2026-59310 (vCenter, 9.8, critical): authentication bypass in VMware Directory Service and directory traversal in the syslog server. Combined, they allow unauthenticated code execution.
Morocco’s maCERT (DGSSI) relayed this advisory on 31 July 2026 (bulletin 67073107/26) with a critical risk level.
Fixed versions
| Product | Affected versions | Fixed version |
|---|---|---|
| ESX 9.1.x | earlier than ESXi-9.1.0.0200-25557999 | ESXi-9.1.0.0200-25557999 (CVE-2026-41709 from ESXi-9.1.0.0-25370933) |
| ESX 9.0.x | earlier than ESXi-9.0.2.0100-25595025 | ESXi-9.0.2.0100-25595025 |
| ESX 8.0 | earlier than ESXi80U3k-25595708 | ESXi80U3k-25595708 (CVE-2026-41709 from ESXi80U3j-25429389) |
| ESX 7.0 | all | through Broadcom extended support |
| vCenter 9.1.x / 9.0.x | earlier than 9.1.0.0300 / 9.0.2.0100 | 9.1.0.0300 / 9.0.2.0100 |
| vCenter 8.0 | earlier than 8.0 U3k | 8.0 U3k |
| VMware Cloud Foundation 5.x | earlier than 5.2.4 | 5.2.4 and async patch (KB88287) |
| Workstation and Fusion | 25H2 | 26H1 |
Patches are cumulative: there is no need to install earlier ones. Broadcom notes that a recent patch on an 8.0 branch can temporarily block an upgrade to VCF 9.x (“back-in-time” restriction, KB 67077): check this if a major upgrade is planned.
Severity and exploitation
- Published severity: 2.7 (low) for CVE-2026-41709 according to Broadcom, network vector, high privileges required. The weakness listed by NVD is CWE-778 (insufficient logging).
- Exploitation: confirmed by CISA, which added it to the KEV catalogue on 28 October 2026 with a 11 November 2026 deadline for US federal agencies. The FAQ Broadcom published with the advisory stated it had no information about exploitation; so far, neither Broadcom nor CISA has detailed which operations escape the logs.
- Reading: exploitation requires an administrator account that is already compromised, so it is part of an ongoing attack. Patching is also the opportunity to fix the critical CVE-2026-47876 from the same advisory.
Interim measures
Broadcom lists no workaround. Until the update window:
- Isolate management: ESX and vCenter management interfaces reachable only from a dedicated admin network, never from the internet or the user network.
- Reduce privileged accounts: remove unused accounts, enforce separate named accounts and MFA on vCenter, as described in our guide to privileged admin account management.
- Disable SSH and the ESXi Shell when not in use, and enable lockdown mode on vCenter-managed hosts.
- Send logs off the host to a syslog server or a SIEM. The flaw limits some traces, not all: logins, configuration changes and vCenter events remain useful.
Checks to carry out
- Inventory every ESX host and vCenter with its version and build number (vSphere Client or
esxcli system version get). - Compare with the table above, starting with the most critical hosts.
- Review accounts: recently granted administrator roles, local accounts added on hosts, unknown SSH keys.
- Review recent activity: admin logins from unusual addresses, virtual machines created, shut down or exported, virtual network changes.
- Check backups: an offline or immutable, tested copy of your VMs, following the immutable 3-2-1 rule. See also our Veeam best practices for virtual machines.
Our take for businesses in Morocco
We regularly see hosts still on vSphere 7.0, or even 6.7, installed years ago and rarely updated since Broadcom’s licensing changes. These servers will only get these patches through extended support. It is often the right moment to decide: upgrade vSphere or migrate to a platform such as Proxmox VE, with Veeam backups covering both.
How we can help
We inventory your hosts and vCenter servers, apply patches in a controlled window after a backup, isolate management access and check for suspicious activity. We then provide 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.
Sources: Broadcom advisory VMSA-2026-0006, VMSA-2026-0006 FAQ (VMware), CISA alert of 28 October 2026, CISA KEV catalogue, NVD CVE-2026-41709, maCERT bulletin 67073107/26 (DGSSI).
Frequently asked questions
Why worry about a flaw rated “low”?
Broadcom scores it 2.7 under CVSS v3.1 because administrator rights are already needed to exploit it. But on 28 October 2026 CISA added it to its KEV catalogue, which only lists exploited flaws. An attacker who has stolen an administrator account can use it to act without leaving traces in the logs, which makes detection and post-incident investigation harder.
Which ESX versions fix CVE-2026-41709?
According to advisory VMSA-2026-0006: ESXi-9.1.0.0-25370933 for the 9.1 branch, ESXi-9.0.2.0100-25595025 for the 9.0 branch, ESXi80U3j-25429389 for the 8.0 branch and VCF 5.2.4 for VMware Cloud Foundation 5.x. As patches are cumulative, we recommend installing the versions that also fix CVE-2026-47876: ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025 or ESXi80U3k-25595708.
Is there a workaround?
No. Broadcom’s advisory states that no workaround exists for the VMSA-2026-0006 flaws. Restricting access to host and vCenter management lowers the risk but does not replace the update.
My server still runs vSphere 7.0 or 6.7, what should I do?
vSphere 7.0 left general support on 2 October 2025: patches are only available through an extended support contract with Broadcom. Versions 6.5 and 6.7 are no longer evaluated and must be assumed affected. Plan an upgrade or a migration, for example to Proxmox VE.
About the editorial team
ALLSAFE SOLUTIONS
Network, security and cloud engineers
Written by the engineering team at ALLSAFE SOLUTIONS, a managed IT provider founded in Casablanca by network, security and cloud engineers. Our articles draw on the projects we deliver for clients in Morocco and abroad.
LinkedIn
