Detect VMware ESX Insufficient Logging of Administrative Operations (CVE-2026-41709) in Microsoft Sentinel
Detects abuse of CVE-2026-41709, an insufficient logging vulnerability (CWE-778) in VMware ESX (also bundled in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform). A malicious administrator can perform certain operations on an ESX host without those operations being logged, which defeats audit trails and hides post-compromise activity on hypervisors. The CVE is on the CISA KEV catalog (added 2026-10-28, BOD 26-04), indicating confirmed exploitation. Because the flaw suppresses the very evidence defenders rely on, detection focuses on what remains observable: privileged ESXi sessions (SSH, ESXi Shell, DCUI) that open with no matching hostd/vpxa/shell audit entries, tampering with syslog and audit-record settings, stopped or restarted logging daemons, and sudden silence from an ESXi log source that was previously chatty.
MITRE ATT&CK
- Tactic
- Stealth Privilege Escalation
KQL Detection Query
// df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence
let window = 1h;
let esxiSyslog = Syslog
| where TimeGenerated > ago(24h)
| where ProcessName in~ ("Hostd", "Vpxa", "shell", "sshd", "vmsyslogd", "auditd", "esxcli") or SyslogMessage has "ESXi";
let tamper = esxiSyslog
| where SyslogMessage has_any ("auditRecord", "syslog.global", "Syslog.global.logHost", "vmsyslogd", "Logging stopped", "log rotation disabled")
| where SyslogMessage has_any ("set", "disable", "stop", "remove", "unconfigure", "restart")
| extend Signal = "LoggingConfigChange";
let silentLogin = esxiSyslog
| where ProcessName =~ "sshd" and SyslogMessage has "Accepted"
| project LoginTime = TimeGenerated, Computer, LoginMsg = SyslogMessage
| join kind=leftanti (
esxiSyslog
| where ProcessName in~ ("shell", "Hostd", "esxcli")
| project Computer, CmdTime = TimeGenerated
) on Computer
| extend Signal = "SessionWithoutCommandAudit";
let gone = esxiSyslog
| summarize LastSeen = max(TimeGenerated), Events = count() by Computer
| where LastSeen < ago(window) and Events > 50
| extend Signal = "LogSourceWentSilent";
union
(tamper | project TimeGenerated, Computer, Signal, Detail = SyslogMessage),
(silentLogin | project TimeGenerated = LoginTime, Computer, Signal, Detail = LoginMsg),
(gone | project TimeGenerated = LastSeen, Computer, Signal, Detail = strcat("events_24h=", Events))
| order by TimeGenerated descCorrelates ESXi syslog for logging-configuration changes, SSH sessions accepted with no command or hostd audit trail on the same host, and ESXi hosts whose log stream stops after previously reporting, the observable footprints of unlogged administrative actions.
Data Sources
Required Tables
False Positives & Tuning
- Planned changes to remote syslog targets or log retention by the virtualization team
- ESXi host reboots, maintenance mode or patching that interrupt log forwarding
- Automation or monitoring SSH logins that run no audited commands
Other platforms for CVE-2026-41709
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are further down this page.
- Test 1 Change ESXi remote syslog target
Expected signal: Syslog entries on the ESXi host and collector showing syslog.global.logHost being set and the syslog service reloading.
- Test 2 Enable SSH session on ESXi lab host
Expected signal: Service start events and an sshd Accepted entry in ESXi syslog.
Response Playbook
Triage
- Confirm the host runs an affected ESX build (9.1 before ESXi-9.1.0.0-25370933, 9.0 before ESXi-9.0.2.0100-25595025, 8.0 before ESXi80U3j-25429389) per Broadcom advisory 38017.
- Review the alert: identify the ESXi host, the account used, and the time of the logging configuration change or the unaudited session.
- Compare ESXi-side logs with the forwarded SIEM copy and with vCenter task and event history for the same window to find operations that exist in one source but not the other.
- Check whether the logging change or session matches an approved change ticket or a known automation account.
Containment
- Restrict ESXi administrative access: disable SSH and the ESXi Shell, enforce lockdown mode, and limit management network reachability.
- Suspend or rotate credentials for any administrator account involved and review the full list of accounts with the Administrator role.
- Restore remote syslog and audit-record settings from a known-good baseline, then apply the Broadcom patch.
Evidence Collection
- Export vCenter events and tasks, ESXi shell.log, hostd.log, auth.log and the configstore for the affected host before any reboot.
- Capture the current esxcli system syslog config get and system auditRecord get output and compare it with the baseline.
- Preserve authentication logs from the identity provider or AD for the administrator accounts used.
Escalation Criteria
- !Escalate to incident response if logging was disabled or altered outside an approved change.
- !Escalate if the same administrator account shows activity on multiple ESXi hosts with missing audit entries.
- !Escalate if VM exports, snapshots, datastore access or credential changes are found around the unlogged window.
Investigation Guide
Forensic Artifacts
- >
ESXi /var/log/auth.log, shell.log, hostd.log and vmsyslogd configuration - >
vCenter event and task database entries for the host - >
Remote syslog collector records and gaps in per-host event volume
Tuning Guidance
This vulnerability removes evidence, so rules are indirect and best treated as medium-fidelity. Baseline per-host ESXi log volume and alert on sustained drops while the host is up. Allowlist change-managed accounts that legitimately reconfigure syslog, and keep lockdown mode on so SSH logins are rare and each one is notable. Patching is the definitive fix.
Hunting Queries
Builds an hourly per-host ESXi event baseline so unexplained drops in log volume stand out.
// df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence
Syslog | where TimeGenerated > ago(7d) | where Computer has "esx" | summarize Events = count() by Computer, bin(TimeGenerated, 1h) | order by Computer asc, TimeGenerated asc``` df00tech DF00-8b26a0fdc0 · https://df00tech.com/detections/CVE-2026-41709 · licence: https://df00tech.com/detections/licence ```
index=vmware earliest=-7d | timechart span=1h count by hostAtomic Red Team Tests
Changes the ESXi remote syslog host and reloads syslog, producing the configuration-change telemetry the detection keys on. Run only on a lab host.
Command
esxcli system syslog config set --loghost='udp://192.0.2.10:514' && esxcli system syslog reloadCleanup
esxcli system syslog config set --loghost='' && esxcli system syslog reloadExpected Telemetry
Syslog entries on the ESXi host and collector showing syslog.global.logHost being set and the syslog service reloading.
Expected Detection
LoggingConfigChange signal fires in the KQL and SPL rules.
Starts the SSH service on a lab ESXi host and opens a session that runs no audited commands, to exercise the session-without-command-audit check.
Command
vim-cmd hostsvc/enable_ssh && vim-cmd hostsvc/start_sshCleanup
vim-cmd hostsvc/stop_ssh && vim-cmd hostsvc/disable_sshExpected Telemetry
Service start events and an sshd Accepted entry in ESXi syslog.
Expected Detection
SessionWithoutCommandAudit signal appears when no shell or hostd command entries follow the login.