CVE-2026-41709

LOW2.7

CISA KEV

Published 2026-07-30 · Updated 2026-10-28 · Source security@vmware.com

Summary

CVE-2026-41709 is a low-severity (CVSS 2.7) vulnerability in Broadcom VMware ESX. CISA added it to the Known Exploited Vulnerabilities catalog on October 28, 2026, which means exploitation in the wild has been confirmed; US federal agencies must remediate it by November 11, 2026. CISA does not currently list it as used in ransomware campaigns. Broadcom has 6 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.

All 6 known-exploited Broadcom vulnerabilities →

Description

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CWE-778

CISA Known-Exploited Vulnerability

Product: Broadcom — VMware ESX

Name: Broadcom VMWare ESX Insufficient Logging Vulnerability

Date added: 2026-10-28 · Due: 2026-11-11

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited Broadcom vulnerabilities

Most recently added to CISA KEV

CVE-2026-59310
RANSOMWARE
VMware vCenter — Broadcom VMware vCenter Path Traversal Vulnerability
added 2026-08-18
CVE-2026-22719
VMware Aria Operations — Broadcom VMware Aria Operations Command Injection Vulnerability
added 2026-03-03
CVE-2024-37079
VMware vCenter Server — Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
added 2026-01-23
CVE-2025-41244
VMware Aria Operations and VMware Tools — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
added 2025-10-30
CVE-2025-1976
Brocade Fabric OS — Broadcom Brocade Fabric OS Code Injection Vulnerability
added 2025-04-28

View all →

Related CVEs

Same severity, most recent

CVE-2026-118585
A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
2026-10-29 · score 3.5
CVE-2026-118691
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user's cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.
2026-10-28 · score 3.7
CVE-2026-3583
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
2026-10-28 · score 3.1
CVE-2026-118681
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
2026-10-28 · score 3.7
CVE-2026-118258
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.
2026-10-28 · score 3.7