CISA put a 2.7 on its exploited list. It is a logging gap in VMware ESX, which is the one thing CVSS cannot score

CVE-2026-41709 went on CISA's Known Exploited Vulnerabilities catalogue on 28 October, due 11 November. The CVE record, assigned by VMware, describes it in one sentence: "VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged."

Broadcom scores it 2.7, which is Low.

A 2.7 on the exploited list

The vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. Nothing is disclosed, nothing is taken down, integrity impact is rated low, and the attacker needs high privileges before any of it applies. On a scale that runs to 10, this is close to the floor, and the weakness class is CWE-778, insufficient logging.

The catalogue does not ask how severe a flaw is. It asks whether somebody is using it, and the answer here was yes. 2.7 and actively exploited is not a contradiction, it is a demonstration that the 2 questions have never been the same question.

Why an intruder wants a 2.7

The PR:H in that vector is usually read as a reason to relax, and it is closer to the opposite. It tells you where this flaw sits in an attack: not at the entrance but after it. Nobody breaks in with a 2.7. They reach for it once they are already administrator, so that what they do next is never written down.

That is worth more than it scores. An intrusion is reconstructed from logs, and an attacker who can act without generating them has removed the thing your response depends on.

Think about what that costs on the day. The scope of a breach, the list of systems touched, the question of whether data left, the regulator's deadline and the insurer's questionnaire are all answered from recorded events. Where the events were never recorded, the honest answer to every one of them becomes that you do not know, and nobody gets to treat that answer as reassuring. The hypervisor is the right place to want that, too. We wrote about Qilin and INC pivoting to the virtualisation layer and disabling ESXi security controls so that the guests see nothing, which is the same instinct served by a flaw that was already in the product.

The patch has been available since July

The CVE record was published on 30 July 2026 and last updated on 29 October, the day after the catalogue listing. Affected products are VMware Cloud Foundation 9.1.x, 9.0.x and 5.x, vSphere Foundation 9.1.x and 9.0.x, ESX 9.1.x, 9.0.x and 8.0, and Telco Cloud Platform 5.1.x and 5.0.x.

So the fix is roughly 3 months old, and the reason many estates will not have applied it is the score. A 2.7 does not survive a change-control queue that is also holding a stack of nines. That is how a low-severity flaw stays available long enough to be worth exploiting.

One more detail from the catalogue entry. CISA records known ransomware use as unknown, and it does not request forensic triage here, while the Linux kernel flaw added the same day does carry that flag.

What to do

• Patch the affected lines. The advisory sits behind Broadcom's support portal, which refuses anonymous requests, so take the version list above from the CVE record and check it against your estate.
• Ship ESXi logs off the host. A gap in local logging matters far less when the same events are already in a syslog target the hypervisor cannot edit.
• Alert on administrative authentication to ESXi and vCenter, rather than on what happens afterwards. If the afterwards can be made invisible, the login is the event you still have.
• Stop triaging only by CVSS. This entry is the argument, and it is not the first this year.
• Treat an absence in the logs as a finding. Hosts that stop producing the events they normally produce are telling you something.

What is not established

• Who exploited it, when, and in what campaign. CISA publishes the listing and not the evidence.
• Whether it was used by a ransomware operation. The catalogue records that as unknown.
• Which operations exactly go unlogged. The CVE record says "certain operations" and leaves it there.
• Whether the exploitation needed a separate flaw to get administrator first, which the vector implies but nobody has described.
• What Broadcom's own advisory adds, since it is not readable without an account.