What is the CVSS score of CVE-2026-41709?

CVE-2026-41709 has a contested CVSS base score of 2.7 from a third party (e.g. CISA-ADP), while the vendor rates it Low. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-41709?

Yes, a patch is available for CVE-2026-41709. Update the affected software to the latest version immediately.

VMware ESX CVE-2026-41709

EUVD-2026-51107 LOW

Insufficient Logging (CWE-778)

2026-07-30 vmware

GHSA-vpqj-56x2-gp9p

Information Disclosure VMware Cloud Foundation Telco Cloud Platform Esx Vsphere Foundation

Low

Disputed · 2.7 Vendor: vmware

Severity by source

Sources disagree (Low–High)

Vendor (vmware) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

2.7 LOW

PR:H required because exploitation demands existing administrator credentials; I:L reflects unlogged operations enabling undetected integrity changes; C and A remain N as no data is exposed or service disrupted.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:50 vuln.today

CVE Published

Jul 30, 2026 - 12:45 cve.org

LOW 2.7

DescriptionCVE.org

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

AnalysisAI

Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.

Technical ContextAI

CWE-778 (Insufficient Logging) describes a condition where security-relevant events are not recorded with enough detail to support accountability and forensic investigation. VMware ESX is the core bare-metal hypervisor underpinning VMware's virtualization stack; it is exposed across Cloud Foundation (cpe:2.3:a:vmware:cloud_foundation), vSphere Foundation (cpe:2.3:a:vmware:vsphere_foundation), ESX itself (cpe:2.3:a:vmware:esx), and Telco Cloud Platform (cpe:2.3:a:vmware:telco_cloud_platform). The vulnerability implies that specific administrative API calls or management-plane actions bypass the audit subsystem, leaving no authoritative record of those operations. This breaks the chain of custody required by frameworks such as PCI-DSS, HIPAA, and SOC 2 that mandate administrator activity logging on hypervisor infrastructure.

RemediationAI

Consult the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 for the authoritative patched version and upgrade instructions; exact fix versions are not confirmed from available intelligence and should not be inferred. Until a patch is applied, compensating controls include enabling external syslog forwarding to an immutable SIEM so that any logs the hypervisor does emit are preserved out-of-band and cannot be tampered with by a local admin - this does not fix the missing log entries but limits the attacker's ability to alter records that are captured. Additionally, applying strict role separation and privileged access workstation (PAW) policies to limit the number of accounts with full ESX administrator rights reduces the population of principals who could exploit this flaw. Periodic reconciliation of administrator activity against change-management tickets can surface undocumented actions even in the absence of complete logs.