Skip to content
CVE-2026-41709 IBM QRadar · QRadar

Detect VMware ESX Insufficient Logging of Administrative Operations (CVE-2026-41709) in IBM QRadar

Detects abuse of CVE-2026-41709, an insufficient logging vulnerability (CWE-778) in VMware ESX (also bundled in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform). A malicious administrator can perform certain operations on an ESX host without those operations being logged, which defeats audit trails and hides post-compromise activity on hypervisors. The CVE is on the CISA KEV catalog (added 2026-10-28, BOD 26-04), indicating confirmed exploitation. Because the flaw suppresses the very evidence defenders rely on, detection focuses on what remains observable: privileged ESXi sessions (SSH, ESXi Shell, DCUI) that open with no matching hostd/vpxa/shell audit entries, tampering with syslog and audit-record settings, stopped or restarted logging daemons, and sudden silence from an ESXi log source that was previously chatty.

MITRE ATT&CK

Tactic
Stealth Privilege Escalation

QRadar Detection Query

IBM QRadar (QRadar)
sql 
-- df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence
SELECT QIDNAME(qid) AS event, LOGSOURCENAME(logsourceid) AS logsource, sourceip, username, UTF8(payload) AS raw FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%VMware ESX%' AND (UTF8(payload) IMATCHES '.*(auditRecord|syslog\.global|logHost|vmsyslogd).*' AND UTF8(payload) IMATCHES '.*(set|disable|stop|remove|unconfigure|restart).*') ORDER BY starttime DESC LAST 24 HOURS
medium severity low confidence

QRadar AQL for ESXi log sources showing audit-record or syslog configuration changes that may accompany administrative actions that evade logging.

Data Sources

VMware ESX/ESXi DSM

Required Tables

events

False Positives & Tuning

  • Planned log destination changes
  • Host patching and reconfiguration
  • Baseline hardening scripts that reapply syslog settings

Other platforms for CVE-2026-41709

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.

  1. Test 1 Change ESXi remote syslog target

    Expected signal: Syslog entries on the ESXi host and collector showing syslog.global.logHost being set and the syslog service reloading.

  2. Test 2 Enable SSH session on ESXi lab host

    Expected signal: Service start events and an sshd Accepted entry in ESXi syslog.

Last updated: Research depth: standard
References (3)

Response Playbook

Triage

  1. Confirm the host runs an affected ESX build (9.1 before ESXi-9.1.0.0-25370933, 9.0 before ESXi-9.0.2.0100-25595025, 8.0 before ESXi80U3j-25429389) per Broadcom advisory 38017.
  2. Review the alert: identify the ESXi host, the account used, and the time of the logging configuration change or the unaudited session.
  3. Compare ESXi-side logs with the forwarded SIEM copy and with vCenter task and event history for the same window to find operations that exist in one source but not the other.
  4. Check whether the logging change or session matches an approved change ticket or a known automation account.

Containment

  1. Restrict ESXi administrative access: disable SSH and the ESXi Shell, enforce lockdown mode, and limit management network reachability.
  2. Suspend or rotate credentials for any administrator account involved and review the full list of accounts with the Administrator role.
  3. Restore remote syslog and audit-record settings from a known-good baseline, then apply the Broadcom patch.

Evidence Collection

  1. Export vCenter events and tasks, ESXi shell.log, hostd.log, auth.log and the configstore for the affected host before any reboot.
  2. Capture the current esxcli system syslog config get and system auditRecord get output and compare it with the baseline.
  3. Preserve authentication logs from the identity provider or AD for the administrator accounts used.

Escalation Criteria

  • !Escalate to incident response if logging was disabled or altered outside an approved change.
  • !Escalate if the same administrator account shows activity on multiple ESXi hosts with missing audit entries.
  • !Escalate if VM exports, snapshots, datastore access or credential changes are found around the unlogged window.

Investigation Guide

Forensic Artifacts

  • >ESXi /var/log/auth.log, shell.log, hostd.log and vmsyslogd configuration
  • >vCenter event and task database entries for the host
  • >Remote syslog collector records and gaps in per-host event volume

Tuning Guidance

This vulnerability removes evidence, so rules are indirect and best treated as medium-fidelity. Baseline per-host ESXi log volume and alert on sustained drops while the host is up. Allowlist change-managed accounts that legitimately reconfigure syslog, and keep lockdown mode on so SSH logins are rare and each one is notable. Patching is the definitive fix.

Hunting Queries

Builds an hourly per-host ESXi event baseline so unexplained drops in log volume stand out.

Hunting — KQL
kql 
// df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence
Syslog | where TimeGenerated > ago(7d) | where Computer has "esx" | summarize Events = count() by Computer, bin(TimeGenerated, 1h) | order by Computer asc, TimeGenerated asc
Hunting — SPL
spl 
``` df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence ```
index=vmware earliest=-7d | timechart span=1h count by host

Atomic Red Team Tests

Test 1 Change ESXi remote syslog target
linux

Changes the ESXi remote syslog host and reloads syslog, producing the configuration-change telemetry the detection keys on. Run only on a lab host.

Command

bash 
esxcli system syslog config set --loghost='udp://192.0.2.10:514' && esxcli system syslog reload

Cleanup

bash 
esxcli system syslog config set --loghost='' && esxcli system syslog reload

Expected Telemetry

Syslog entries on the ESXi host and collector showing syslog.global.logHost being set and the syslog service reloading.

Expected Detection

LoggingConfigChange signal fires in the KQL and SPL rules.

Test 2 Enable SSH session on ESXi lab host
linux

Starts the SSH service on a lab ESXi host and opens a session that runs no audited commands, to exercise the session-without-command-audit check.

Command

bash 
vim-cmd hostsvc/enable_ssh && vim-cmd hostsvc/start_ssh

Cleanup

bash 
vim-cmd hostsvc/stop_ssh && vim-cmd hostsvc/disable_ssh

Expected Telemetry

Service start events and an sshd Accepted entry in ESXi syslog.

Expected Detection

SessionWithoutCommandAudit signal appears when no shell or hostd command entries follow the login.

Related Detections

Tactic Hubs

TA0005 Stealth TA0004 Privilege Escalation ATT&CK Matrix

Related Techniques

T1685.001 Disable Windows Event Logging T1070 Indicator Removal T1078 Valid Accounts

Same Tactic: Stealth

Popular Detections