Read the docs
TI-2026-30225 Aliases CVE-2026-41709GHSA-vpqj-56x2-gp9p

Insufficient logging in VMware ESX lets admins run unlogged operations

Priority HIGH 71Exploited in the wildCWE-778Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

VMware ESX contains insufficient logging (CWE-778), so a malicious administrator can perform certain operations without them being logged. The administrator needs high privileges and can exploit the flaw over the network. CISA lists it in its Known Exploited Vulnerabilities catalog, with the date added 2026-10-28.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

Why it matters now

Exploitation Active In CISA KEV since 2026-10-28CISA due date 2026-11-11
EPSS 0.00689 52nd percentileScored 2026-11-07
Fix Fixed Cloud Foundation (VMware): 5.2.4ESX (VMware): ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareCloud Foundation9.1.x.x; 9.0.x.x; 5.x to before 5.2.45.2.4Patch availableCNA
VMwarevSphere Foundation9.1.x.x; 9.0.x.x—No fix listedCNA
VMwareESX9.1.x.x to before ESXi-9.1.0.0-25370933; 9.0.x.x to before ESXi-9.0.2.0100-25595025; 8.0 to before ESXi80U3j-25429389ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389Patch availableCNA
VMwareTelco Cloud Platform5.1.x; 5.0.x—No fix listedCNA
  • Cloud Foundation VendorVMware Affected 9.1.x.x; 9.0.x.x; 5.x to before 5.2.4 Fixed in 5.2.4 Patch available CNA
  • vSphere Foundation VendorVMware Affected 9.1.x.x; 9.0.x.x Fixed in — No fix listed CNA
  • ESX VendorVMware Affected 9.1.x.x to before ESXi-9.1.0.0-25370933; 9.0.x.x to before ESXi-9.0.2.0100-25595025; 8.0 to before ESXi80U3j-25429389 Fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 Patch available CNA
  • Telco Cloud Platform VendorVMware Affected 5.1.x; 5.0.x Fixed in — No fix listed CNA

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*9.0.0 to before 9.0.2.0100VulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*8.0VulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*8.0 aVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*8.0 bVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*8.0 cVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:d:*:*:*:*:*:*8.0 dVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:e:*:*:*:*:*:*8.0 eVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:f:*:*:*:*:*:*8.0 fVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:g:*:*:*:*:*:*8.0 gVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*8.0 update_1VulnerableVMware
  • cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.0.2.0100 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:d:*:*:*:*:*:* Versions 8.0 d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:e:*:*:*:*:*:* Versions 8.0 e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:f:*:*:*:*:*:* Versions 8.0 f Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:g:*:*:*:*:*:* Versions 8.0 g Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* Versions 8.0 update_1 Vulnerable ·VMware
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*8.0 update_1aVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*8.0 update_1cVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*8.0 update_1dVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*8.0 update_2VulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*8.0 update_2bVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*8.0 update_2cVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_2d:*:*:*:*:*:*8.0 update_2dVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_2e:*:*:*:*:*:*8.0 update_2eVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_2f:*:*:*:*:*:*8.0 update_2fVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*8.0 update_3VulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*8.0 update_3bVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*8.0 update_3cVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3d:*:*:*:*:*:*8.0 update_3dVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3e:*:*:*:*:*:*8.0 update_3eVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3f:*:*:*:*:*:*8.0 update_3fVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3g:*:*:*:*:*:*8.0 update_3gVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3h:*:*:*:*:*:*8.0 update_3hVulnerableVMware
cpe:2.3:o:vmware:esxi:8.0:update_3i:*:*:*:*:*:*8.0 update_3iVulnerableVMware
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*5.0 to before 5.2.4Running onVMware
cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*5.0 to before 5.2Running onVMware
cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:*not specified by NVDRunning onVMware
  • cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* Versions 8.0 update_1a Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* Versions 8.0 update_1c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:* Versions 8.0 update_1d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* Versions 8.0 update_2 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:* Versions 8.0 update_2b Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:* Versions 8.0 update_2c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_2d:*:*:*:*:*:* Versions 8.0 update_2d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_2e:*:*:*:*:*:* Versions 8.0 update_2e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_2f:*:*:*:*:*:* Versions 8.0 update_2f Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:* Versions 8.0 update_3 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:* Versions 8.0 update_3b Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:* Versions 8.0 update_3c Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3d:*:*:*:*:*:* Versions 8.0 update_3d Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3e:*:*:*:*:*:* Versions 8.0 update_3e Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3f:*:*:*:*:*:* Versions 8.0 update_3f Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3g:*:*:*:*:*:* Versions 8.0 update_3g Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3h:*:*:*:*:*:* Versions 8.0 update_3h Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:8.0:update_3i:*:*:*:*:*:* Versions 8.0 update_3i Vulnerable ·VMware
  • cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 5.0 to before 5.2.4 Running on ·VMware
  • cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:* Versions 5.0 to before 5.2 Running on ·VMware
  • cpe:2.3:a:vmware:vsphere_foundation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·VMware

Remediation

Update ESX to ESXi-9.1.0.0-25370933 for 9.1.x.x, ESXi-9.0.2.0100-25595025 for 9.0.x.x, or ESXi80U3j-25429389 for 8.0, and update Cloud Foundation 5.x to 5.2.4. The sources list no fixed version for vSphere Foundation or Telco Cloud Platform. CISA's due date for the fix is 2026-11-11.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Cloud Foundation (VMware) Fixed in 5.2.4
  • Fix · CNA ESX (VMware) Fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41709
  2. 2026-10-03 Alias added: GHSA-vpqj-56x2-gp9p
  3. 2026-10-28 Added to CISA KEV
  4. 2026-10-28 Priority changed: LOW → HIGH
  5. 2026-10-28 CISA SSVC decision points changed
  6. 2026-10-29 EPSS moved to the 50th–90th percentile
  7. 2026-10-29 CISA SSVC decision points changed

References

Advisory 1

  • TI-2020-03488 Use after free in VMware ESXi KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-16135 Time-of-check time-of-use race condition in VMware ESXi KEVCVSS 3.1CRITICAL 9.3
  • TI-2025-16136 Out-of-bounds write in VMware ESXi KEVCVSS 3.1HIGH 8.2
  • TI-2010-03709 The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS)… KEVCVSS 3.1HIGH 7.8
  • TI-2024-24615 Authentication bypass in VMware ESXi KEVCVSS 3.1HIGH 7.2
See all 139 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences