CVE-2026-41709 was published to the National Vulnerability Database on 30 July 2026 and modified on 29 October. It carries exactly one score, and that score is not NVD's.

The record reads: NIST NVD, base score N/A, assessment not yet provided. Underneath it, CNA VMware, base score 2.7 LOW, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. The weakness class is CWE-778, insufficient logging. Nobody has rescored it independently in the three months since.

On 28 October CISA added it to the Known Exploited Vulnerabilities catalogue, with a remediation date of 11 November. That is a 14-day window, which under the tiering we went through in the previous piece means CISA judged the technical impact partial rather than total.

The description, in full

VMware's own text is two sentences: "VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged."

That is the whole flaw. Certain operations do not reach the log.

The vector is the argument

Take the string apart and the 2.7 makes perfect sense on its own terms.

PR:H says you already need administrator privileges. C:N says nothing is disclosed. I:L says integrity is barely touched. A:N says nothing goes down. By the arithmetic CVSS defines, this is close to the floor of the scale.

Now notice what the scale is made of. Confidentiality, integrity, availability, privileges, complexity, interaction, scope. There is no field for whether the defender finds out. There is no metric that goes up when the evidence of an intrusion is the thing being destroyed.

So a flaw whose entire effect is on the forensic record scores as though it has almost no effect at all. The number is not wrong. It is answering a different question from the one a defender is asking.

What it was actually used for

This is where the sourcing has to be precise, because the parts that make it a story are not in the primary record.

CrowdStrike is reported to have attributed zero-day exploitation of this flaw to a China-linked group it tracks as WARP PANDA, in intrusions reaching into early 2026, with the reporting credited to Ian Barton. The fix is reported to have shipped in VMSA-2026-0006 on 29 July 2026.

We could not read Broadcom's advisory. Its support portal answers an unauthenticated reader with "Error: Content not found!" and a line saying the feature has been disabled by an administrator. A vendor advisory that a member of the public cannot open is not a source we are willing to cite as though we had read it.

One secondary outlet lists the score as 7.6, which contradicts the 2.7 in NVD. We have no way to reconcile those, and the figure on the record is the one on the cover.

Three months as a Low

The dates stack up badly. Fixed on 29 July. Published as a 2.7 the next day. Added to KEV on 28 October, three months later.

For most of that window, anyone triaging by score had every reason to leave it. A 2.7 does not survive a prioritisation meeting. That is not a failure of the people in the meeting.

Why this pairs with the directive

BOD 26-04 requires forensic triage for compromise on its most urgent tier. Triage means reading the record of what happened. This flaw is a defect in that record.

Put them side by side and the awkwardness is obvious: the policy response to the worst flaws depends on logs, and a flaw that quietly removes entries from those logs scores 2.7 and sits in the catalogue for three months before anyone has to act on it.

What to do

  • Patch ESX to the fixed build, and treat 11 November as the date rather than a suggestion if the directive binds you.
  • Do not let a Low close the question. Check whether the flaw's effect is on evidence rather than on data, because the scale has no way to say so.
  • Pull ESX logs for the period and compare them against something outside the host. vCenter events, network flow records, storage telemetry. A logging flaw is only invisible if you look in one place.
  • Review who holds administrator on your hypervisors. PR:H is a real precondition, and it is also a standing one in most estates.
  • Add a rule to your own scoring: anything in CWE-778 and its neighbours gets reviewed by a human, whatever the number says.

What is not established

  • Who exploited it. The attribution is secondary reporting, not a primary advisory we were able to read.
  • How many organisations were affected, or over what period. No count has been published.
  • Which operations go unlogged. The description says certain operations and stops there.
  • Why NVD has not scored it. The record simply says the assessment is not yet provided.
  • Why one outlet reports 7.6. We can see the discrepancy and cannot explain it.
  • Whether 14 days is the right call. CISA publishes the deadline, not the reasoning behind it.