VMware ESX: CISA Confirms Exploited Logging Flaw; Fix in VMSA-2026-0006
The insufficient logging flaw CVE-2026-41709 in VMware ESX lets an attacker with admin access perform operations without them being logged. CISA added it to the KEV catalog on October 28 after CrowdStrike attributed zero-day use to China-linked Warp Panda against the U.S. legal sector; the fix is in VMSA-2026-0006, with a federal deadline of November 11. Two other flaws from the same July 29 advisories, CVE-2026-59309 and CVE-2026-59310, have also been exploited in the wild.
What happened
On October 28, CISA added VMware ESX flaw CVE-2026-41709 to its Known Exploited Vulnerabilities catalog. CrowdStrike says the China-linked Warp Panda group used it as a zero-day to perform actions without leaving logs, including at U.S. law firms. Broadcom has already released the fix in advisory VMSA-2026-0006.
Why it matters
The flaw matters after access: it hides the attacker's actions once an admin account is taken, cutting the audit trail. A compromised company may detect the intrusion late and struggle to prove what was accessed. CISA lists ransomware use as unknown.
What to do
Apply VMSA-2026-0006: builds ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 or ESXi80U3j-25429389 or newer. Review who holds ESX admin rights and compare host activity against vCenter and network logs.
For the technical team
- CVE
- CVE-2026-41709
- Affected
- Broadcom VMware ESX · VMware ESX/ESXi. Disclosed on July 29 alongside three critical and one high-severity bug in VMware vCenter, ESXi, Workstation, and Fusion.
- Exploitation
- Confirmed: CISA listed CVE-2026-41709 in the KEV catalog on October 28, federal deadline November 11. CrowdStrike reported zero-day use by China-nexus Warp Panda in intrusions at US organizations, including law firms, throughout 2025 and as late as early 2026. Ransomware use: unknown, per the KEV entry.
- Fix
- VMSA-2026-0006 from Broadcom. Patches in builds ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 and newer releases.
- Vector
- VMware ESX/ESXi, insufficient logging vulnerability (low severity, per SecurityWeek). Requires admin privileges; the attacker then performs certain operations without them being logged, reducing audit trail visibility.
- More details
- According to CrowdStrike, Warp Panda typically gains initial access through internet-facing edge devices and pivots to VMware vCenter, where it deployed the listed malware. Two other flaws from the July 29 advisories have also been exploited in the wild: CVE-2026-59309 (critical authentication bypass) and CVE-2026-59310 (critical directory traversal leading to arbitrary code execution); in mid-August, Quirso reported roughly 360 web-accessible vCenter servers compromised via CVE-2026-59310 with an SSH reverse shell, attributing the activity to a China-linked threat actor. The same October 28 KEV update listed the Fragnesia Linux kernel flaw, CVE-2026-46300, with an October 31 due date.
Timeline
CISA formally added the flaw to the KEV catalog on October 28, and the item confirms a fix is already available in Broadcom advisory VMSA-2026-0006, with a federal deadline of November 11.
SecurityWeek details that the low-severity flaw was used as a zero-day by Chinese hackers: CVE-2026-41709 lets attackers with administrative privileges perform operations without being logged.
CrowdStrike details that the attacks targeted the U.S. legal sector, and CISA adds CVE-2026-41709 to the KEV catalog.
Want the next updates in your inbox? Get the daily edition →
See all 5 updates
CrowdStrike attributes the attacks to China-linked Warp Panda, which targeted the U.S. legal sector.
New KEV entry lists CVE-2026-41709 with a federal remediation deadline of November 11, 2026.
Sources 5 sources
- CVE-2026-41709: Broadcom VMware ESX (Broadcom VMWare ESX Insufficient Logging Vulnerability) CISA KEV
- @TheHackersNews @TheHackersNews
- China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility The Hacker News
- Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day SecurityWeek
- @DailyDarkWeb @DailyDarkWeb
