What happened
A critical vulnerability has been identified in Broadcom VMware ESX. This flaw, assigned CVE-2026-41709, involves insufficient logging capabilities within the product. Exploitation of this weakness could enable a malicious actor with administrative access to perform certain operations without generating logs, thereby obscuring the activity from detection. The vulnerability has been actively exploited in the wild, increasing the potential impact for affected deployments.
Who is affected
Organizations running Broadcom VMware ESX are impacted by this vulnerability. Any deployment with administrative access to the affected product is at risk. The severity is deemed critical, given the active exploitation and the nature of the weakness.
Recommended actions
- Apply mitigations in accordance with vendor instructions.
- Ensure compliance with CISA’s BOD 26-04 guidance on prioritizing security updates based on risk, particularly for cloud services.
- Follow CISA’s “Forensics Triage Requirements” to facilitate incident response and evidence collection.
- If suitable mitigations are not available, consider discontinuing the use of the affected product.
- Stakeholders should evaluate each affected asset’s internet exposure and adhere to patching guidelines outlined by CISA.
