VMware ESX CVE-2026-41709: Low-Rated Logging Flaw Now in CISA KEV After Zero-Day Use

On 28 October 2026, CISA added CVE-2026-41709, an insufficient-logging flaw in Broadcom's VMware ESX hypervisor, to its Known Exploited Vulnerabilities (KEV) catalog (CISA alert). Broadcom rates the flaw Low, CVSSv3 2.7, and fixed it on 29 July 2026 in security advisory VMSA-2026-0006 (Broadcom VMSA-2026-0006).

Start with what this flaw is not. It is not remote code execution, and it does not let an outsider in. Broadcom says an attacker must already be an ESX administrator. What it gives that administrator is the ability to perform "certain operations without them being logged."

That is why a Low score still earned a KEV entry. CrowdStrike, whose researcher reported the flaw to Broadcom, says a China-nexus adversary it tracks as WARP PANDA used it as a zero-day in intrusions at U.S.-based entities, including legal-sector targets, as late as early 2026 (CrowdStrike). After a hypervisor is compromised, the host's own logs are what investigators rely on. This flaw can leave gaps in exactly that record.

Hypervisors sit under the hosting, managed-infrastructure and private-cloud services many organisations buy. That makes this a supplier question as well as an internal patch.

Technical Information

What the flaw is. Broadcom describes CVE-2026-41709 as an insufficient-logging vulnerability in VMware ESX (CWE-778). A malicious administrator could exploit it to perform certain operations without them being logged. Broadcom has not said which operations are affected, and CrowdStrike calls it an "ESXi command logging bypass" without further detail. We do not speculate beyond that.

Why the score is Low. Broadcom's CVSSv3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N: administrator-level privileges required, no confidentiality or availability impact, and a low integrity impact (the missing log entries). On its own, the flaw gives an attacker nothing they did not already have, except less visibility for defenders. NVD lists the record as "Undergoing Analysis" and has not published its own score; the 2.7 is Broadcom's, as the CVE Numbering Authority (NVD; CVE record).

Why it matters anyway. An attacker who already holds ESX administrator access can use it to keep some follow-up activity out of the host's records. For incident response, that means an ESX host's local logs from before the patch may be incomplete, even if they look clean.

Exploitation status. CISA lists CVE-2026-41709 in KEV, added 28 October 2026, with a due date of 11 November 2026 for U.S. Federal Civilian Executive Branch agencies under Binding Operational Directive (BOD) 26-04. CISA marks known ransomware campaign use as "Unknown" (KEV catalog version 2026.10.28, checked 29 October 2026). The only public account of exploitation we found is CrowdStrike's. In a 28 October summary of its 2026 Legal Threat Landscape Report, CrowdStrike says WARP PANDA deployed several forms of malware in victims' VMware vCenter environments and, in several of those cases, exploited CVE-2026-41709 as a zero-day, as late as early 2026. CrowdStrike gives no number of affected organisations, and neither do we. We have not verified its account independently, and we have not read the full report, which CrowdStrike offers as a separate download.

Context on the adversary. In December 2025, before this CVE was public, CrowdStrike described WARP PANDA as targeting VMware vCenter and ESXi environments, with tradecraft that includes log clearing and file timestomping (CrowdStrike, Unveiling WARP PANDA). That post does not mention CVE-2026-41709.

Timeline (dates as published):

• 29 July 2026: Broadcom publishes VMSA-2026-0006, which includes the fix for CVE-2026-41709 and credits Ian Barton of CrowdStrike for reporting it [Broadcom VMSA-2026-0006].
• 3 and 19 August 2026: Broadcom revises the advisory twice (.1 and .2). Neither change concerns CVE-2026-41709 [Broadcom change log].
• 28 October 2026: CrowdStrike publishes the summary of its 2026 Legal Threat Landscape Report naming CVE-2026-41709 as a WARP PANDA zero-day [CrowdStrike].
• 28 October 2026: CISA adds CVE-2026-41709 to KEV; catalog version 2026.10.28 was released at 21:00 Cyprus time [CISA alert; KEV catalog].
• 11 November 2026: KEV due date for U.S. federal civilian agencies [CISA KEV].

Affected Product Versions

From Broadcom's response matrix for CVE-2026-41709 in VMSA-2026-0006. Broadcom rates the issue Low (CVSSv3 2.7) on every line.

Broadcom's matrix for this CVE does not list ESX 7.0. The advisory's 19 August revision added ESX 7.0 guidance for other, higher-severity issues in the same advisory. Broadcom does not state whether 7.0 is affected by this flaw; if you still run 7.0, ask Broadcom rather than assume.

VMSA-2026-0006 covers several vulnerabilities and carries a higher overall rating because of other, more serious issues in it. That overall rating does not apply to CVE-2026-41709, which Broadcom rates Low.

Workaround and Mitigation

1. Patch. Update each ESX host to the fixed build for its line in the table above. Broadcom lists no workaround.
2. Get logs off the host (Rescana guidance, in line with CrowdStrike's December 2025 WARP PANDA recommendations). Forward ESXi and vCenter syslog to an external platform that ESX administrators cannot alter, and retain it. A patch closes this gap; it does not make local logs trustworthy on a host that was already compromised.
3. Watch the access this flaw depends on. CrowdStrike's WARP PANDA recommendations include monitoring SSH logins to ESXi, particularly as root and vpxuser; considering disabling SSH to ESXi hosts; enabling ESXi's execInstalledOnly setting; restricting outbound internet access from ESXi and vCenter; and accessing vCenter only through an identity provider that enforces MFA (CrowdStrike). Those recommendations predate this CVE and target the adversary, not the flaw itself.
4. Review before you trust (Rescana guidance). If ESX hosts ran unpatched builds through early 2026 and show any sign of unexpected administrator activity, do not rely on host logs alone. Compare them with vCenter records, externally forwarded syslog and network data.

Indicators of Compromise

None published. Broadcom, CISA and CrowdStrike's 28 October summary give no indicators of compromise for CVE-2026-41709. CrowdStrike has published actor-level detail on WARP PANDA elsewhere; we do not reproduce it here because it is not specific to this flaw.

What we will update

We will update this post if Broadcom revises VMSA-2026-0006 for this CVE (for example, to describe which operations go unlogged or to address ESX 7.0), if CISA changes the KEV entry (including the ransomware field), if NVD publishes its own score, if CrowdStrike or a national CERT publishes more detail on exploitation, or if a hosting or managed-infrastructure provider issues its own notice.

Sources

• Broadcom (VMware): VMSA-2026-0006, section 3e, "ESX insufficient logging vulnerability (CVE-2026-41709)", issued 29 July 2026, updated 19 August 2026: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017; Telco Cloud Platform KB449886: https://knowledge.broadcom.com/external/article/449886
• CISA: "CISA Adds Two Known Exploited Vulnerabilities to Catalog", 28 October 2026: https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog; KEV catalog entry (catalog version 2026.10.28, checked 29 October 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• NVD and CVE Program: https://nvd.nist.gov/vuln/detail/CVE-2026-41709; https://www.cve.org/CVERecord?id=CVE-2026-41709
• CrowdStrike: "CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies", 28 October 2026: https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/; "Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary", 4 December 2025: https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/

Why this matters for your vendors

Your hosting, managed-infrastructure, VDI and private-cloud suppliers likely run ESX under the workloads they operate for you. A flaw that hides administrator activity matters most when you need a supplier to tell you what happened, so ask both whether they have patched and whether their hypervisor logs leave the host.

Forward this to your TPRM owner: Four short questions for hosting, managed-service and private-cloud suppliers (Rescana guidance):

• Do you run VMware ESX, VMware Cloud Foundation or vSphere Foundation under services you provide to us?
• Are those hosts on the fixed builds Broadcom lists for CVE-2026-41709, and if any run ESX 7.0, what has Broadcom told you?
• Are ESXi and vCenter logs forwarded to a system that ESX administrators cannot alter, and how long are they kept?
• Have you reviewed administrator and SSH activity on hosts that ran unpatched builds, and would you tell us if you found something?

Working through infrastructure suppliers on questions like these? We can help you track their answers alongside the rest of their security posture. Book a demo.