CVE-2026-41709
Low2.7CISA KEV — exploited in the wildCloud Foundation: ESX insufficient logging vulnerabilitytitle from the CVE record
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
- CVSS
- 2.7v3.1
- EPSS (exploit probability)
- 0.3%22th pct
- CISA KEV
- Listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-28 | 0.3% | 22.3% |
| 2026-10-27 | 0.3% | 22.2% |
| 2026-10-26 | 0.3% | 22.2% |
| 2026-10-25 | 0.3% | 22.1% |
| 2026-10-24 | 0.3% | 21.3% |
| 2026-10-23 | 0.3% | 21.2% |
| 2026-10-22 | 0.3% | 21.2% |
| 2026-10-21 | 0.3% | 21.1% |
| 2026-10-20 | 0.3% | 21.0% |
| 2026-10-19 | 0.3% | 21.0% |
| 2026-10-18 | 0.3% | 20.9% |
| 2026-10-17 | 0.3% | 20.9% |
| 2026-10-16 | 0.3% | 20.9% |
| 2026-10-15 | 0.3% | 20.8% |
| 2026-10-14 | 0.3% | 20.8% |
| 2026-10-13 | 0.3% | 20.7% |
| 2026-10-12 | 0.3% | 20.6% |
| 2026-10-11 | 0.3% | 20.6% |
| 2026-10-10 | 0.3% | 20.6% |
| 2026-10-09 | 0.3% | 20.5% |
| 2026-10-08 | 0.3% | 20.5% |
| 2026-10-07 | 0.3% | 20.5% |
| 2026-10-06 | 0.3% | 20.4% |
| 2026-10-05 | 0.3% | 20.3% |
| 2026-10-04 | 0.3% | 20.3% |
| 2026-10-03 | 0.3% | 20.3% |
| 2026-10-02 | 0.3% | 20.3% |
| 2026-10-01 | 0.3% | 20.2% |
| 2026-09-30 | 0.3% | 20.2% |
| 2026-09-29 | 0.3% | 20.1% |
| 2026-09-27 | 0.3% | 20.1% |
CISA KEV entrycatalogue 2026.10.28
- Date added
- 2026-10-28
- Federal due date
- 2026-11-11
- Known ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Verbatim from the CISA KEV catalogue (CISA KEV, fetched 2026-10-28 22:23 UTC). The due date applies to US federal agencies under BOD 22-01.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Learn