Skip to content
CVE-2026-41709

VMware ESX Insufficient Logging of Administrative Operations (CVE-2026-41709)

Stealth Privilege Escalation Last updated:

Detects abuse of CVE-2026-41709, an insufficient logging vulnerability (CWE-778) in VMware ESX (also bundled in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform). A malicious administrator can perform certain operations on an ESX host without those operations being logged, which defeats audit trails and hides post-compromise activity on hypervisors. The CVE is on the CISA KEV catalog (added 2026-10-28, BOD 26-04), indicating confirmed exploitation. Because the flaw suppresses the very evidence defenders rely on, detection focuses on what remains observable: privileged ESXi sessions (SSH, ESXi Shell, DCUI) that open with no matching hostd/vpxa/shell audit entries, tampering with syslog and audit-record settings, stopped or restarted logging daemons, and sudden silence from an ESXi log source that was previously chatty.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Broadcom, VMware
Product
VMware ESX, VMware Cloud Foundation, VMware vSphere Foundation, VMware Telco Cloud Platform
Versions
ESX 9.1.x.x before ESXi-9.1.0.0-25370933, ESX 9.0.x.x before ESXi-9.0.2.0100-25595025, ESX 8.0 before ESXi80U3j-25429389, VMware Cloud Foundation 5.x before 5.2.4

Weakness (CWE)

CWE-778

Timeline

Disclosed
July 30, 2026

CVSS

2.7
Low (0.1–3.9)
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

What is CVE-2026-41709 VMware ESX Insufficient Logging of Administrative Operations (CVE-2026-41709)?

VMware ESX Insufficient Logging of Administrative Operations (CVE-2026-41709) (CVE-2026-41709) maps to the Stealth and Privilege Escalation tactics — the adversary is trying to hide and conceal their actions, appearing as normal behavior in MITRE ATT&CK.

This page provides production-ready detection logic for VMware ESX Insufficient Logging of Administrative Operations (CVE-2026-41709), covering the data sources and telemetry it touches: Syslog (ESXi forwarded), VMware ESXi syslog via Azure Monitor Agent. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Stealth Privilege Escalation
Microsoft Sentinel / Defender
kusto 
// df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence
let window = 1h;
let esxiSyslog = Syslog
    | where TimeGenerated > ago(24h)
    | where ProcessName in~ ("Hostd", "Vpxa", "shell", "sshd", "vmsyslogd", "auditd", "esxcli") or SyslogMessage has "ESXi";
let tamper = esxiSyslog
    | where SyslogMessage has_any ("auditRecord", "syslog.global", "Syslog.global.logHost", "vmsyslogd", "Logging stopped", "log rotation disabled")
    | where SyslogMessage has_any ("set", "disable", "stop", "remove", "unconfigure", "restart")
    | extend Signal = "LoggingConfigChange";
let silentLogin = esxiSyslog
    | where ProcessName =~ "sshd" and SyslogMessage has "Accepted"
    | project LoginTime = TimeGenerated, Computer, LoginMsg = SyslogMessage
    | join kind=leftanti (
        esxiSyslog
        | where ProcessName in~ ("shell", "Hostd", "esxcli")
        | project Computer, CmdTime = TimeGenerated
      ) on Computer
    | extend Signal = "SessionWithoutCommandAudit";
let gone = esxiSyslog
    | summarize LastSeen = max(TimeGenerated), Events = count() by Computer
    | where LastSeen < ago(window) and Events > 50
    | extend Signal = "LogSourceWentSilent";
union
    (tamper | project TimeGenerated, Computer, Signal, Detail = SyslogMessage),
    (silentLogin | project TimeGenerated = LoginTime, Computer, Signal, Detail = LoginMsg),
    (gone | project TimeGenerated = LastSeen, Computer, Signal, Detail = strcat("events_24h=", Events))
| order by TimeGenerated desc

Correlates ESXi syslog for logging-configuration changes, SSH sessions accepted with no command or hostd audit trail on the same host, and ESXi hosts whose log stream stops after previously reporting, the observable footprints of unlogged administrative actions.

medium severity medium confidence

Data Sources

Syslog (ESXi forwarded) VMware ESXi syslog via Azure Monitor Agent

Required Tables

Syslog

False Positives

  • Planned changes to remote syslog targets or log retention by the virtualization team
  • ESXi host reboots, maintenance mode or patching that interrupt log forwarding
  • Automation or monitoring SSH logins that run no audited commands

Query fingerprint DF00-8b26a0fdc0 · licence

Sigma logsource & community rules

The detection logic for VMware ESX Insufficient Logging of Administrative Operations (CVE-2026-41709) (CVE-2026-41709) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: azure

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-41709 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-41709

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Research depth: standard
References (3)

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.

  1. Test 1 Change ESXi remote syslog target

    Expected signal: Syslog entries on the ESXi host and collector showing syslog.global.logHost being set and the syslog service reloading.

  2. Test 2 Enable SSH session on ESXi lab host

    Expected signal: Service start events and an sshd Accepted entry in ESXi syslog.

Response Playbook

Triage

  1. Confirm the host runs an affected ESX build (9.1 before ESXi-9.1.0.0-25370933, 9.0 before ESXi-9.0.2.0100-25595025, 8.0 before ESXi80U3j-25429389) per Broadcom advisory 38017.
  2. Review the alert: identify the ESXi host, the account used, and the time of the logging configuration change or the unaudited session.
  3. Compare ESXi-side logs with the forwarded SIEM copy and with vCenter task and event history for the same window to find operations that exist in one source but not the other.
  4. Check whether the logging change or session matches an approved change ticket or a known automation account.

Containment

  1. Restrict ESXi administrative access: disable SSH and the ESXi Shell, enforce lockdown mode, and limit management network reachability.
  2. Suspend or rotate credentials for any administrator account involved and review the full list of accounts with the Administrator role.
  3. Restore remote syslog and audit-record settings from a known-good baseline, then apply the Broadcom patch.

Evidence Collection

  1. Export vCenter events and tasks, ESXi shell.log, hostd.log, auth.log and the configstore for the affected host before any reboot.
  2. Capture the current esxcli system syslog config get and system auditRecord get output and compare it with the baseline.
  3. Preserve authentication logs from the identity provider or AD for the administrator accounts used.

Escalation Criteria

  • ! Escalate to incident response if logging was disabled or altered outside an approved change.
  • ! Escalate if the same administrator account shows activity on multiple ESXi hosts with missing audit entries.
  • ! Escalate if VM exports, snapshots, datastore access or credential changes are found around the unlogged window.

Investigation Guide

Forensic Artifacts

  • > ESXi /var/log/auth.log, shell.log, hostd.log and vmsyslogd configuration
  • > vCenter event and task database entries for the host
  • > Remote syslog collector records and gaps in per-host event volume

Tuning Guidance

This vulnerability removes evidence, so rules are indirect and best treated as medium-fidelity. Baseline per-host ESXi log volume and alert on sustained drops while the host is up. Allowlist change-managed accounts that legitimately reconfigure syslog, and keep lockdown mode on so SSH logins are rare and each one is notable. Patching is the definitive fix.

Hunting Queries

Builds an hourly per-host ESXi event baseline so unexplained drops in log volume stand out.

Hunting — KQL
kql 
// df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence
Syslog | where TimeGenerated > ago(7d) | where Computer has "esx" | summarize Events = count() by Computer, bin(TimeGenerated, 1h) | order by Computer asc, TimeGenerated asc
Hunting — SPL
spl 
``` df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence ```
index=vmware earliest=-7d | timechart span=1h count by host

Atomic Red Team Tests

Test 1 Change ESXi remote syslog target
linux

Changes the ESXi remote syslog host and reloads syslog, producing the configuration-change telemetry the detection keys on. Run only on a lab host.

Command

bash 
esxcli system syslog config set --loghost='udp://192.0.2.10:514' && esxcli system syslog reload

Cleanup

bash 
esxcli system syslog config set --loghost='' && esxcli system syslog reload

Expected Telemetry

Syslog entries on the ESXi host and collector showing syslog.global.logHost being set and the syslog service reloading.

Expected Detection

LoggingConfigChange signal fires in the KQL and SPL rules.

Test 2 Enable SSH session on ESXi lab host
linux

Starts the SSH service on a lab ESXi host and opens a session that runs no audited commands, to exercise the session-without-command-audit check.

Command

bash 
vim-cmd hostsvc/enable_ssh && vim-cmd hostsvc/start_ssh

Cleanup

bash 
vim-cmd hostsvc/stop_ssh && vim-cmd hostsvc/disable_ssh

Expected Telemetry

Service start events and an sshd Accepted entry in ESXi syslog.

Expected Detection

SessionWithoutCommandAudit signal appears when no shell or hostd command entries follow the login.

Related Detections

Tactic Hubs

TA0005 Stealth TA0004 Privilege Escalation ATT&CK Matrix

Related Techniques

T1685.001 Disable Windows Event Logging T1070 Indicator Removal T1078 Valid Accounts

Same Tactic: Stealth

Popular Detections

Browse by tactic

Full ATT&CK matrix Search all detections