CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on 2026-10-28. The flaw is described as an insufficient logging vulnerability in Broadcom VMware ESX that could let a malicious actor with admin access perform certain operations without those actions being recorded. CISA’s required action is to apply mitigations according to the vendor’s instructions and to follow the guidance in CISA’s BOD 26-04 and the “Forensics Triage Requirements” linked in the notes. 1