ESX insufficient logging vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Listed in CISA KEV
- Fix
- Fixed in 5.2.4, ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389
- Public exploit
- None on Exploit-DB
- Exploitation: active
- Automatable: no
- Technical impact: partial
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
VMware ESX, a virtualization platform for running virtual machines, is affected by this vulnerability. A user with administrator access could perform certain actions that would not be recorded in the system logs, making it harder to detect or audit those activities.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Affected versions
- VMware Cloud Foundation
From 5.x · fixed in 5.2.4
- VMware vSphere Foundation
9.1.x.x, 9.0.x.x
- VMware ESX
From 9.1.x.x · fixed in ESXi-9.1.0.0-25370933; From 9.0.x.x · fixed in ESXi-9.0.2.0100-25595025; From 8.0 · fixed in ESXi80U3j-25429389
- VMware Telco Cloud Platform
5.1.x, 5.0.x