CISA hat am 28.10.2026 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 11.11.2026.
Erforderliche Maßnahme: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-41709
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| VMware | Cloud Foundation | 9.1.x.x, 9.0.x.x, 5.x – < 5.2.4 | |
| VMware | ESX | 9.1.x.x – < ESXi-9.1.0.0-25370933, 9.0.x.x – < ESXi-9.0.2.0100-25595025, 8.0 – < ESXi80U3j-25429389 | |
| vmware | esxi | 9.0.0 – < 9.0.2.0100 | |
| VMware | Telco Cloud Platform | 5.1.x, 5.0.x | |
| VMware | vSphere Foundation | 9.1.x.x, 9.0.x.x |
cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.2.0100cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:d:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:e:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:f:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:g:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2d:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2e:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_2f:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3d:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3e:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3f:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3g:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3h:*:*:*:*:*:*cpe:2.3:o:vmware:esxi:8.0:update_3i:*:*:*:*:*:*Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.