VMware ESX CVE-2026-41709: administrator actions never reach the log
On 28 October CISA added CVE-2026-41709 to the known-exploited catalog. This is not a remote break-in of ESX. It is a logging gap: some administrator operations can be performed with no record.
In the October feed the word VMware meant two different things, and they should not be glued together. CVE-2026-41709 is about ESX and logs. The eMudhra story is about trusted-certificate lists in Broadcom products. The first does not let someone in from the street. The second does not erase a log. Both are worth time, for different reasons.
What is confirmed
CISA describes CVE-2026-41709 briefly: because logging is insufficient, an administrator can perform some operations and they will not be recorded. It entered the catalog on 28 October 2026, which means it has been used, not only discussed. That hurts exactly when you need to answer who powered a machine off or who changed the network. The log may have no line, even though the operation still needs an administrator account. This is not RCE, and it is not a reason to write that ESX is broken into without a password.
The patch comes from Broadcom when it ships for your branch. Until then it is more useful to narrow who holds ESX administrator rights, and to stop treating the log as the only witness. If you already had an incident and the logs are empty, this bug is exactly why empty does not mean nothing happened.
Related Lexora services
The ESX log is empty where a trace should be
We can tell whether this is the logging gap or someone already clearing records. Those are different conversations and different actions.