CVE-2026-41709: insufficient logging in VMware ESX
Broadcom rates this ESX logging flaw Low at 2.7, and it requires administrator access. CrowdStrike says an adversary it tracks as WARP PANDA exploited it as a zero-day.
·
What the flaw is
Broadcom says a malicious administrator could exploit CVE-2026-41709 to perform certain operations without them being logged. Its advisory does not say which operations. Broadcom scores the flaw 2.7, Low, on CVSSv3, and credits Ian Barton of CrowdStrike with reporting it.
Exploitation so far
CISA added the CVE to its Known Exploited Vulnerabilities catalog on 28 October 2026, with an 11 November deadline for US federal civilian agencies, and lists ransomware use as unknown.
CrowdStrike says WARP PANDA, which it describes as China-nexus, deployed malware in VMware vCenter environments during intrusions at US-based entities, including legal-sector targets. It says that in several cases, and as late as early 2026, the adversary exploited this flaw as a zero-day. Rescana says this is the only public account of exploitation it found. Rising has not verified it independently.
Rescana also argues that ESX host logs from before the patch may be incomplete even when they look clean, because the flaw affects the record investigators rely on.
What to do
Broadcom lists no workaround. Its fixed versions are ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389, with 5.2.4 for VMware Cloud Foundation 5.x and KB449886 for Telco Cloud Platform 5.0.x and 5.1.x.
The same advisory, first published on 29 July 2026, covers vCenter flaws that Broadcom scores 9.8, including CVE-2026-59309 and CVE-2026-59310. Check vCenter as well as ESX.
Official records
Further reading
- Rescana ↗: Why a Low-rated flaw reached the KEV catalog, and what it means for investigators.
- CrowdStrike ↗: The public account of WARP PANDA using this flaw.