Broadcom · VMware ESX
CVE-2026-41709
ESX insufficient logging vulnerability
概要
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
CISA: Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
対処法
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
米国連邦機関の対応期限：2026年11月11日
Broadcomのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/08/18 | Path Traversal | VMware vCenter | 緊急 9.8 | 62% |
| 2026/03/03 | Command Injection | VMware Aria Operations | 高 8.1 | 18% |
| 2026/01/23 | Out-of-bounds Write | VMware vCenter Server | 緊急 9.8 | 22% |
| 2025/10/30 | Privilege Defined with Unsafe Actions | VMware Aria Operations and VMware Tools | 高 7.8 | 16% |
| 2025/04/28 | Code Injection | Brocade Fabric OS | 高 8.6 | 0.7% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。