VMware · week of 26 Oct 2026

VMware security note

Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.

What changed

CVE-2026-41709 — Patch now
VMware cloud_foundation Insufficient Logging
Affected < 9.0.2.0100
CVE-2026-22738 — Check if you run it
In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key.
Affected < 1.0.5

What we still do not know

Every changed record in this note has a version range.

Share this note

VMware security note, week of 26 Oct 2026: 2 records have a version a customer can check, and 0 still do not. https://zerodayfindings.com/technologies/vmware/notes/2026-W44