VMware ESX CVE-2026-41709 (admin operations not logged, VMSA-2026-0006) added to CISA KEV on Oct 28, 2026. Which ESXi builds fix it, and what else does that advisory cover?

What it is: CVE-2026-41709 is a low-severity (CVSS 2.7) insufficient-logging flaw in VMware ESX: someone who already has administrator access can perform certain operations without them being written to the logs. On its own it doesn't give access, but it helps an intruder who has taken over an ESXi admin account hide what they did, which is why CISA added it to the Known Exploited Vulnerabilities catalog on October 28, 2026 (federal deadline November 11). It was fixed in Broadcom advisory VMSA-2026-0006 (July 29, 2026, updated in August), which also fixed critical vCenter flaws (CVE-2026-59309 auth bypass, CVE-2026-59310 code execution) and a critical ESX VMXNET3 flaw (CVE-2026-47876). If CVE-2026-41709 is being exploited, ransomware-style ESXi intrusions are the likely context, so unpatched hosts from that advisory deserve attention now. Am I affected: - ESX/ESXi builds older than: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, or VCF 5.2.4 (see the advisory for Telco Cloud and older lines). ESX 7.0 has no listed patch; Broadcom asks extended-support customers to contact support. - Check with esxcli system version get on the host, or in vCenter. Fix: 1. Apply the ESXi patches from VMSA-2026-0006 (for 8.0, at least 8.0 U3k / ESXi80U3k-25595708, which also covers the VMXNET3 issue; 8.0 U2f on that line). Patch vCenter to 9.1.0.0300, 9.0.2.0100, 8.0 U3k or U2f in the same window. 2. Plan the move off ESX/vCenter 7.0 if you're still on it. 3. Because this bug is about missing logs, also review admin access: who holds ESXi root and vCenter admin rights, MFA on vCenter SSO, ESXi lockdown mode, SSH disabled when not needed, and logs forwarded to a remote syslog server the hosts can't modify. 4. If you suspect an ESXi admin account was compromised, rotate host root and vCenter credentials and check for unexpected VIBs, users and changed settings. Verify: esxcli system version get reports a build at or above the fixed one, vCenter shows the fixed version, and remote syslog is receiving events. Sources: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://nvd.nist.gov/vuln/detail/CVE-2026-41709