Source: cisa.gov
CVE-2026-41709 is an insufficient logging vulnerability affecting Broadcom VMware ESX. The flaw allows a malicious actor with administrative access to perform certain operations without those actions being recorded in logs. This creates a significant blind spot for security monitoring and forensic investigation. The vulnerability was catalogued by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Broadcom has published a security advisory with remediation details. The absence of audit trails for admin actions could facilitate insider threats or post-compromise lateral movement without detection. Organizations running VMware ESX are advised to apply the relevant security updates promptly.
