CISA Warns of VMWare ESX Logging Vulnerability Exploited in Attacks

A vulnerability in VMware ESX allows administrator actions to occur without being recorded in logs, effectively creating blind spots during incident investigations and forensic analysis. Even though Broadcom rated the flaw as low severity, CISA's addition to its Known Exploited Vulnerabilities catalog confirms that threat actors are actively leveraging it — demonstrating that severity scores alone should not drive patching priorities. When logging integrity is compromised, defenders lose the ability to reconstruct attacker timelines, detect lateral movement, or attribute malicious activity. This matters because hypervisor-level blind spots can shield attackers operating across entire virtualised environments, amplifying the blast radius of any breach.