A VMware ESX bug that Broadcom rated Low has turned out to be a zero-day. CrowdStrike says a China-linked group exploited CVE-2026-41709 to run operations without leaving log entries, and CISA has reportedly added it to its Known Exploited Vulnerabilities (KEV) catalog. The flaw gives no access by itself, but it helps an intruder who already holds administrator rights stay hidden.
What happened
CVE-2026-41709 is an insufficient-logging flaw in VMware ESX. Broadcom fixed it on July 29, 2026 as one of five issues in advisory VMSA-2026-0006, which was last revised on August 19. The advisory says a malicious administrator could perform certain operations without them being logged, and it rates this issue Low with a CVSS 3.1 base score of 2.7. Broadcom credits Ian Barton of CrowdStrike with reporting it.
On October 28, CrowdStrike published its 2026 Legal Threat Landscape Report. In its entry on the group it tracks as WARP PANDA, CrowdStrike says that in several cases, and as late as early 2026, the adversary exploited this ESXi command-logging bypass as a zero-day. The report places the group’s intrusions at U.S.-based organizations, some in the legal sector, and says it deployed malware in victims’ VMware vCenter environments.
Security Affairs reported on October 29 that CISA added the flaw to KEV, with a federal remediation deadline of November 11, 2026. We could not load CISA’s own entry, so treat the listing and the date as secondary reporting. That article also lists the score as 7.6, which differs from Broadcom’s 2.7; we rely on Broadcom’s advisory here.
Why it matters
A Low score can mislead. Defenders often sort patches by CVSS, and this bug only matters after an attacker already has admin access. In that situation, missing logs on a hypervisor can leave investigators with little evidence of what happened on the virtualization layer. Security Affairs, citing CrowdStrike, says the group targets internet-facing edge devices, steals cloud session tokens and registers unauthorized MFA devices, which is a reminder that the log gap is one step in a longer chain. CrowdStrike’s summary does not establish which other VMware flaws, if any, were used together with this one.
Who is affected
Organizations running VMware ESX, including those on VMware Cloud Foundation and Telco Cloud Platform. Broadcom lists no workaround. Its response matrix names these fixes:
- ESX 9.1: ESXi-9.1.0.0-25370933
- ESX 9.0: ESXi-9.0.2.0100-25595025
- ESX 8.0: ESXi80U3j-25429389
- VMware Cloud Foundation 5.x: 5.2.4
- Telco Cloud Platform ESX 5.0.x and 5.1.x: KB449886
Broadcom’s supplemental Q&A also says versions not listed should be assumed affected and that vSphere 7 is affected, so check the advisory for your exact version.
What to do
The steps below are our analysis, except the patching instructions, which come from Broadcom.
- Apply the fixed build from VMSA-2026-0006 for your ESX line. Federal agencies face a November 11 deadline; everyone else should treat it as a priority.
- Forward ESX logs to a separate syslog or SIEM destination, so a local logging gap does not erase your only record.
- Limit who holds ESX and vCenter administrator rights, restrict management-network access, and review recent administrator logins.
- Look for gaps or unusual silence in ESX logs since early 2026, and check for new MFA devices or odd session-token use in connected cloud accounts.
- Do not rely on CVSS alone for prioritization; give weight to the CISA KEV catalog.
What we still do not know
Neither Broadcom nor CrowdStrike has published a victim count in the material we reviewed, and Broadcom’s Q&A, which dates from August 19, still said it had no information about exploitation in the wild. It is not clear which specific operations were hidden, whether other VMware flaws were chained with this one, or whether indicators of compromise will be released. We could not confirm the CISA entry directly.
Sources: Broadcom VMSA-2026-0006.2 (July 29, updated Aug 19, 2026); VMSA-2026-0006 Q&A (Aug 19, 2026); CrowdStrike 2026 Legal Threat Landscape Report (Oct 28, 2026); Security Affairs (Oct 29, 2026); Cyber Security News (Oct 29, 2026).
Leave a Reply