Most people skip a CVSS 2.7. This one deserves a second look. CVE-2026-41709 affects VMware ESX, and it is now on CISA's Known Exploited Vulnerabilities (KEV) list. The bug does not give anyone admin access. It lets someone who already has admin access do certain things without the log entry you would expect.

I first covered this in a longer write-up on our blog . This version is shorter and focuses on what you can check on your own hosts.

The short version

What it is: an insufficient logging flaw in VMware ESX, tracked as CWE-778 (important events are not recorded). The NVD record was published on 2026-07-30.

What it is not: a remote takeover. The attacker needs high privileges first.

Why it matters: if an admin account is stolen or misused, some actions may leave no trace on the host. That makes an investigation much harder.

Severity, and why KEV changes the picture

NVD scores it 2.7 LOW , with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N .

The important part is PR:H .…