EUVD-2026-51107
GHSA-vpqj-56x2-gp9p
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
PR:H required because exploitation demands existing administrator credentials; I:L reflects unlogged operations enabling undetected integrity changes; C and A remain N as no data is exposed or service disrupted.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
AnalysisAI
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires administrator-level credentials to the VMware ESX or associated management plane, confirmed by the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 2.7 (Low) accurately reflects limited direct technical damage: CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N shows that exploitation requires high privileges (PR:H), produces only low integrity impact (I:L), and has no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A rogue or compromised VMware administrator authenticates to the ESX management interface over the network, then invokes specific management-plane operations - such as modifying VM configurations, adjusting network policies, or altering access controls - that are known to bypass the audit logging subsystem. The operations complete successfully but leave no log entry, allowing the actor to cover tracks during or after a broader intrusion. … |
| Remediation | Consult the Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 for the authoritative patched version and upgrade instructions; exact fix versions are not confirmed from available intelligence and should not be inferred. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cloud Foundation
View allVMware ESXi and Workstation contain a TOCTOU race condition leading to out-of-bounds write, allowing local administrator
VMware ESXi contains an arbitrary write vulnerability that allows privileged VMX process users to trigger kernel writes,
VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability via HGFS out-of-bounds read, allowi
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. Rated critical severity (CV
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. Rated critical sev
Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. Rated h
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and
Same weakness CWE-778 – Insufficient Logging
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today