CVE-2026-41709

LowCVSS 2.7/10Known exploited (CISA KEV)Last modified Oct 29, 2026

Description

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-778

Affected software

Vendor	Product	Versions
VMware	Cloud Foundation	9.1.x.x; 9.0.x.x; >= 5.x, < 5.2.4
VMware	vSphere Foundation	9.1.x.x; 9.0.x.x
VMware	ESX	>= 9.1.x.x, < ESXi-9.1.0.0-25370933; >= 9.0.x.x, < ESXi-9.0.2.0100-25595025; >= 8.0, < ESXi80U3j-25429389
VMware	Telco Cloud Platform	5.1.x; 5.0.x

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709US Government Resource

Timeline

Published: Jul 30, 2026
Last modified: Oct 29, 2026
Added to CISA KEV: Oct 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-41716.3A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functiona CVE-2026-417105.9An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful ret CVE-2026-417115.9Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsin CVE-2026-417127.5Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data expo CVE-2026-417138.2A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applicatio CVE-2026-417144.0Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(tru CVE-2026-417156.1In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In CVE-2026-417167.5Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhausti CVE-2026-417178.1Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter bindi CVE-2026-417196.4A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method CVE-2026-41727.2A vulnerability was detected in TRENDnet TEW-632BRP 1.010B32. This affects an unknown part of the file /ping_response.cgi of the component H CVE-2026-417207.4Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an emp