What is CVE-2026-41709?

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

CISA added this issue to its exploited-vulnerability catalog on 2026-10-28. This is the catalog date, not this article’s publication date.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-41709 — NVD

First, confirm where the vulnerable product is running

CVE-2026-41709 describes an insufficient logging vulnerability in Broadcom VMware ESXi (listed as ESX) that could allow a malicious actor with admin access to perform certain operations without those actions being recorded in audit logs. This is a forensic blind spot: post-incident investigators may lack evidence of privileged activity. The catalog entry does not establish fixed versions, cloud marketplace images, Kubernetes deployments, or managed-cloud service exposure. Remediation depends on the vendor advisory for supported ESXi releases and the vendor-supported upgrade path (e.g., ESXi ISO/offline bundle). Do not apply host-level OS patches or install agents on the hypervisor; these are not supported by the vendor. For cloud deployments, treat customer-managed ESXi instances (e.g., on AWS bare metal, Azure VMware Solution, Google Cloud VMware Engine) as customer-managed software requiring the vendor fix, while managed services (if any) have separate remediation ownership. Verify log integrity after applying the vendor update.

The named vulnerable product is Broadcom VMware ESX. Deployment on a cloud platform does not by itself establish that a managed AWS, Azure or GCP service is vulnerable. Confirm the product, version, vendor-supported deployment and remediation owner.

Vendor remediation comes first

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Use the current vendor advisory for affected versions and fixed builds. This catalog entry does not establish a universal fixed version or a cloud-specific hotfix.

Sources: CISA Known Exploited Vulnerabilities catalog, CVE-2026-41709 — NVD

AWS: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Identify customer-managed ESXi hosts running on AWS (e.g., EC2 bare metal, VMware Cloud on AWS) and confirm they are in scope for the vendor advisory.
  2. Use AWS Systems Manager Patch Manager only for the guest OS layer; do not expect it to deliver ESXi hypervisor updates. Obtain the vendor-supported ESXi offline bundle/ISO from Broadcom.
  3. Apply the vendor fix via the supported ESXi upgrade path (e.g., esxcli software vib install or offline bundle), then reboot per vendor guidance.
  4. Verify that audit logs now capture the previously unlogged privileged operations after the update.

Sources: AWS Systems Manager Patch Manager

Azure: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Determine whether ESXi runs as customer-managed workloads (e.g., Azure VMware Solution private clouds, Azure bare metal) versus any managed service tier.
  2. Azure Update Manager handles Windows/Linux guest updates; it does not supply ESXi hypervisor patches. Download the vendor fix from Broadcom and apply via the supported ESXi lifecycle process.
  3. If using Azure VMware Solution, coordinate with Microsoft on the service-managed patching cadence for the underlying ESXi hosts; customer responsibility may be limited to workload VMs.
  4. Confirm post-update that ESXi audit logging records administrative actions that were previously missing.

Sources: Azure Update Manager overview

GCP: remediation and deployment checks

Use these checks only if your inventory confirms an affected, vendor-supported deployment in this environment.

  1. Locate any customer-managed ESXi deployments (e.g., Google Cloud VMware Engine, Compute Engine bare metal) and map them to the vendor advisory’s affected releases.
  2. VM Manager Patch operates on guest OS packages; it does not update the ESXi hypervisor. Obtain the vendor-supported ESXi patch bundle and apply using the vendor procedure.
  3. For Google Cloud VMware Engine, check the service documentation for the provider-managed ESXi patching timeline; customer remediation applies only to customer-managed layers.
  4. Validate that the updated ESXi hosts generate log entries for the administrative operations described in the advisory.

Sources: Google Cloud VM Manager — About Patch

How to verify the fix

  1. Compare the ESXi build number after update against the fixed releases listed in the Broadcom security advisory.
  2. Perform a controlled privileged action (e.g., create/delete a VM, modify host firewall) and confirm the action appears in the ESXi audit log (/var/log/vmware/hostd.log or equivalent).
  3. Review SIEM/log forwarder ingestion to ensure the newly generated log events are being collected and parsed correctly.
  4. Document the remediation timestamp, host inventory, and log verification results for compliance with BOD 26-04 and forensics triage requirements.

Questions teams ask

What is the fixed ESXi version for CVE-2026-41709?

The catalog entry does not specify fixed versions. Consult the Broadcom security advisory (VMSA) linked in the CVE record for the exact patched releases and download locations.

Can I use the cloud provider’s patch manager (SSM, Azure Update Manager, VM Manager) to fix the ESXi hypervisor?

No. Those services manage guest OS packages. ESXi hypervisor updates must be applied using the vendor-supported offline bundle/ISO and the ESXi lifecycle tools (esxcli, Update Manager, Lifecycle Manager).

Does this CVE affect managed VMware services like VMware Cloud on AWS, Azure VMware Solution, or Google Cloud VMware Engine?

The catalog does not establish managed service exposure. For each service, check the provider’s security bulletin: the provider may patch the underlying ESXi hosts on their cadence, while customer responsibility typically covers workload VMs and guest OS.

How do I prove the logging gap is closed after patching?

Execute a sample privileged operation that the advisory says was unlogged, then search the hostd.log (or forwarded logs) for the corresponding audit event. Absence of the event before the update and presence after confirms the fix.

Sources & further reading

This brief summarizes public source material. Confirm affected versions and the current vendor instructions before changing production. No original exploit validation is claimed.