CISA flags patched VMware ESX bug as exploited in attacks
CVE-2026-41709 lets a malicious administrator operate without leaving a trace in the logs. Broadcom fixed it in July.
The U.S. cybersecurity agency CISA on Oct. 28 added CVE-2026-41709 to its catalog of known exploited vulnerabilities, citing "evidence of active exploitation." The flaw is in VMware ESX, the Broadcom hypervisor that runs virtual machines on servers.
The patch has been out for months. Broadcom released it in advisory VMSA-2026-0006 on July 29 and updated the advisory on Aug. 19. What changed is that the bug now sits on the list of flaws used in real attacks.
Its severity is low: 2.7 on the CVSS scale.
It is an insufficient-logging bug. A malicious administrator can carry out operations on the server without leaving a record. It does not get an attacker in; it erases footprints once the attacker already has privileges. That is why it made the catalog despite its score, which measures technical damage, not whether exploitation has been proven.
CrowdStrike says in its 2026 report on threats to the legal sector that WARP PANDA, a group it links to China, used CVE-2026-41709 as a zero-day (before a patch existed) in several cases through early 2026. The firm describes the group as one that targets cloud and virtualization environments, wiping logs and creating virtual machines that do not show up in vCenter.
Broadcom says there is no workaround: the fix is to install one of these versions.
| Fixed version | Product |
|---|---|
| ESXi80U3j-25429389 | ESX 8.0 |
| ESXi-9.1.0.0-25370933 | VCF and vSphere Foundation, ESX 9.1.x |
| ESXi-9.0.2.0100-25595025 | VCF and vSphere Foundation, ESX 9.0.x |
| 5.2.4 | VMware Cloud Foundation 5.x (ESX) |
| Broadcom article KB449886 | Telco Cloud Platform 5.0.x and 5.1.x |
| Contact Broadcom Support, with extended support | ESX 7.0 |
The same advisory covers four other flaws, including two critical vCenter bugs rated 9.8 each (CVE-2026-59309 and CVE-2026-59310), so many IT teams may have installed the update in July or August because of those. Neither CISA nor Broadcom has given victim counts.
U.S. federal civilian agencies have until Nov. 11 to fix it.
