What Is an Insufficient Logging Vulnerability (CWE-778)?

An insufficient logging vulnerability is a flaw where software fails to record a security-relevant event, or records it without the details needed to reconstruct what happened. MITRE tracks the class as CWE-778. These bugs rarely give an attacker access by themselves, so they score low on CVSS. Their value is to someone who is already inside and wants their actions missing from the audit trail.

What is an insufficient logging vulnerability?

It is a defect in what a system writes down, not in what it allows. The action still happens and still succeeds, but the log that should show it is empty, partial or misleading.

The weakness takes a few common forms:

• An operation that should produce an audit event produces none.
• The event is written, but without the user, source address, target object or result.
• The event goes to a local file only, where the same administrator who performed the action can delete it.
• A configuration change silently turns off or redirects logging, and that change is not itself logged.

The OWASP Top 10 groups these failures under "Security Logging and Monitoring Failures" (A09:2021), because a missing log and an unwatched log produce the same outcome: nobody notices the intrusion.

Why do attackers exploit logging flaws?

Attackers exploit logging flaws to stay hidden after they already hold access. Every action that does not reach the log is one less clue for detection rules, incident responders and later forensic work.

Mature intruders care a lot about this. Clearing logs is noisy: a log that suddenly goes empty, or a "log cleared" event, is itself a detection signal. A bug that keeps specific operations out of the log in the first place leaves no such trace. That is the value of the ESXi logging zero-day CVE-2026-41709, which CrowdStrike reports the China-nexus group Warp Panda used to reduce audit trail visibility on VMware hosts before Broadcom shipped a fix.

Why insufficient logging scores low on CVSS

CVSS measures the direct impact of exploiting a flaw. An insufficient logging bug usually requires high privileges (the attacker must already be an administrator) and changes no data except the log. So the score lands in the Low range. CVE-2026-41709, for example, scores 2.7 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N.

CVSS does not model what the flaw does to your ability to investigate. A Low score says the bug cannot hurt you on its own. It says nothing about how much a determined intruder gains from it once they are inside. That gap is why exploitation data, such as CISA's KEV catalog, should override CVSS order when the two disagree.

How do you find logging gaps in your own systems?

You find logging gaps by performing known administrative actions in a test environment and confirming that each one appears in the log you would rely on during an incident. If an action you can see on the console never shows up in your collector, you have a gap.

A practical test plan:

1. List the actions that matter for an investigation: logins, privilege changes, configuration edits, service enablement (for example SSH), user creation, and changes to logging itself.
2. Perform each one on a test system with a named account.
3. Check the local log and your central collector or SIEM for a matching event with the user, time, source and result.
4. Record any action that is missing or incomplete, and check vendor advisories for a known issue.
5. Repeat after major upgrades, because logging behavior changes between versions.

Do not trust a log just because it is busy. A host can produce thousands of routine events a day and still be blind to the one operation an attacker uses.

What compensating controls cover a logging gap?

Compensating controls give you a second record of the same activity from a system the attacker does not control. The goal is that no single compromised host can erase the whole story.

• Forward logs off the host. A remote collector keeps copies that a local administrator cannot delete. For VMware hosts, see how to forward ESXi syslog to a remote server.
• Log at the management plane. Actions issued through a central console are often recorded there even when the managed host misses them.
• Watch the network. Flow records and firewall logs for management interfaces show connections that host logs might omit.
• Watch identity. Authentication events from your identity provider show who obtained credentials, even if later actions are hidden.

These layers are a planning decision as much as a technical one. We cover that side in why hypervisor log retention must live off the host.

What to do when a vendor discloses a logging flaw

Patch it on the same schedule as your higher-scored fixes if there is evidence of exploitation. Then treat logs from the unpatched period as possibly incomplete. Look for corroborating evidence in the compensating sources above before you conclude that nothing happened. Missing events from before the patch cannot be recovered, so the review has to rely on records kept somewhere else.