VMware ESX: insufficient logging lets a malicious administrator perform operations without an audit record

Impact

A user who already holds administrative privilege on ESX can carry out certain operations that are never written to the audit log. Nothing is gained in terms of access - the value is purely in erasing the evidence trail, which matters on shared virtualization hosts where the audit log is the only record of who touched a tenant's VM or a passthrough device assignment. The score is 2.7 (integrity-low, no confidentiality or availability impact), but the CVE is listed in CISA KEV, which suggests it is being used as part of longer intrusion chains rather than on its own. Treat it as an incident-response gap: logs from an unpatched ESX host cannot be assumed complete for the affected operations.

Who can reach it

Network-reachable but requires high privilege (AV:N/PR:H) - an account that is already an ESX administrator. Not reachable by a tenant inside a guest VM.

What to do

Apply the ESX update from the Broadcom security advisory (also shipped through VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform channels). The advisory is the authority on fixed build numbers; the record does not state them. An ESX patch normally means evacuating guests and rebooting the host, so plan one drain-and-reboot per host in the cluster. Until then, tighten and review who holds ESX administrator rights and keep external evidence (vCenter-side logs, network telemetry) for the operations ESX will not record.

References

Related entries

• OpenSSH sshd: restrict in authorized_keys does not disable tunnel forwarding as documentedCVE-2026-106586 · OpenSSH sshd (restrict keyword in authorized_keys, tunnel forwarding)Low
• OpenSSH sshd: restrict keyword in authorized_keys did not cover tunnel forwardingCVE-2026-73283 · OpenSSH sshd (authorized_keys restrict keyword vs tunnel forwarding)Low
• OpenSSH sshd: GSSAPI credentials and authentication state persist after a failed attemptCVE-2026-106553 · OpenSSH sshd (GSSAPIAuthentication credential and state handling)Low
• QEMU / KVM / Xen (VENOM): VENOM: out-of-bounds write in the virtual Floppy Disk ControllerCVE-2015-3456 · QEMU / KVM / Xen (VENOM)Low
• Xen (shadow paging): x86 shadow paging arbitrary pointer dereference - host crash or worseCVE-2022-42335 · Xen (shadow paging)Unscored
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDCVE-2022-50619 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Unscored