Our automated tracking framework flagged that CISA added CVE-2026-41709 (Broadcom VMware ESX) to the Known Exploited Vulnerabilities (KEV) catalog on November 2, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-41709 by November 11, 2026 — a 14-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-41709 |
| Vendor / product | Broadcom VMware ESX |
| Vulnerability | Broadcom VMWare ESX Insufficient Logging Vulnerability |
| CVSS base score | 2.7 |
| Added to KEV | October 28, 2026 |
| Days public before listing (NVD → KEV lag) | 90 |
| Federal patch deadline | November 11, 2026 |
| Known ransomware use | No |
How This Compares to Broadcom’s Track Record
This one was public for 90 days before CISA confirmed exploitation — longer than Broadcom’s 25-day median, a vulnerability that sat exploitable in the open.
| Broadcom in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 6 |
| Median lag (public → KEV listing) | 25 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1765 tracked KEV entries is 232 days — Broadcom’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Broadcom KEV Additions
The most recent Broadcom vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-59310 | VMware vCenter | August 18, 2026 | 19 | No |
| CVE-2026-22719 | VMware Aria Operations | March 3, 2026 | 6 | No |
| CVE-2024-37079 | VMware vCenter Server | January 23, 2026 | 584 | No |
| CVE-2025-41244 | VMware Aria Operations and VMware Tools | October 30, 2025 | 31 | No |
| CVE-2025-1976 | Brocade Fabric OS | April 28, 2025 | 4 | No |
What This Means for Defenders
CISA has added CVE-2026-41709, an Insufficient Logging Vulnerability in Broadcom VMware ESX, to its Known Exploited Vulnerabilities (KEV) catalog. It’s been actively exploited. Despite a low CVSS base score of 2.7, its KEV inclusion mandates immediate attention, especially for U.S. federal agencies facing a November 11, 2026 patching deadline. Organizations using VMware ESX environments should patch before November 11, 2026. If you cannot patch by the deadline, restrict access to VMware ESX environments and enhance monitoring for unusual activity.
CVE-2026-41709 was public for 90 days before its KEV listing on October 28, 2026. This allowed attackers a significant window to develop and deploy exploits before the vulnerability was widely known to be exploited in the wild. This period highlights why proactive patching is essential, rather than relying solely on KEV additions.
Related Coverage
- Broadcom’s CVE-2026-59310 Was Exploited in 19 Days — Exactly Its Historical Median (August 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
