{"id":"broadcom-esx-logging-flaw-exploited-oct-2026","category":"patch","status":"live","title":"Broadcom VMware ESX logging flaw CVE-2026-41709 used in attacks; fixed builds available","tldr":"A low-rated Broadcom VMware ESX flaw (CVE-2026-41709) that lets an admin act without leaving logs is now on CISA's exploited list. Mainly a business issue: if you run ESX 8.0, 9.0 or 9.1, install the July builds. No workaround exists.","summary":"CVE-2026-41709 is an insufficient logging flaw in Broadcom's VMware ESX hypervisor, the software that runs virtual servers in data centres. Someone who already has administrator access could carry out certain actions without them being recorded in the logs. Broadcom rated it low severity (CVSS 2.7) and published fixes on 29 July 2026 in advisory VMSA-2026-0006: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, VMware Cloud Foundation 5.2.4, and a knowledge-base article for Telco Cloud Platform. Broadcom lists no workaround and its advisory does not say whether attacks have been seen. On 28 October 2026 CISA added the flaw to its list of exploited vulnerabilities, with a federal deadline of 11 November. Press reports, which HARD could not check against the original, attribute the exploitation to CrowdStrike, which says a China-linked group called Warp Panda used it as a zero-day in early 2026, including against US law firms, to reduce audit trail visibility. Sources disagree on whether ESXi 7.0 has a fix for this flaw. It is a business and data-centre issue, not a home one.","action":"If you run VMware ESX, install the fixed build for your version (9.1, 9.0 or 8.0, or VCF 5.2.4) and ask your IT provider to confirm. Families with no VMware servers have nothing to do.","product":"Broadcom VMware ESX (ESXi) hypervisor and VMware Cloud Foundation","audience":"work","severity":"low","patch":"patched","exploited":true,"cves":["CVE-2026-41709"],"tags":["broadcom","vmware","esx","esxi","hypervisor","cisa-kev","zero-day","logging"],"affected":["VMware ESX 9.1.x (VCF/VSF)","VMware ESX 9.0.x (VCF/VSF)","VMware ESX 8.0","VMware Cloud Foundation 5.x","Telco Cloud Platform 5.0.x and 5.1.x"],"fixed":["ESXi-9.1.0.0-25370933","ESXi-9.0.2.0100-25595025","ESXi80U3j-25429389","VMware Cloud Foundation 5.2.4","Telco Cloud Platform: KB449886"],"matches":[],"sources":[{"kind":"advisory","title":"VMSA-2026-0006.2: VMware ESX security advisory","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","by":"Broadcom","date":"2026-08-19"},{"kind":"news","title":"CISA adds Linux Kernel and Broadcom VMware ESX flaws to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/?p=202050","by":"Security Affairs","date":"2026-10-28"},{"kind":"news","title":"Chinese hackers quietly used low-severity ESXi logging flaw as zero-day","url":"https://securityweek.com/chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day","by":"SecurityWeek","date":"2026-10-29"}],"started":"2026-10-28","closed":null,"created":"2026-11-03T22:05:23.852Z","updated":"2026-11-03T22:05:23.852Z","cve_notes":[{"cve":"CVE-2026-41709","name":"Insufficient logging in VMware ESX","what":"A logging gap in VMware ESX, the software that runs virtual servers, that lets a malicious administrator carry out certain operations without them being recorded, which makes an intrusion harder to trace.","severity":"low","cvss":2.7}],"timeline":[{"at":"2026-10-28","added":"2026-11-03T22:00:26.134Z","kind":"cisa-added","text":"CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalogue, with a federal agency deadline of 11 November 2026. News reports link this to CrowdStrike's finding that a China-linked group, Warp Panda, used the flaw as a zero-day in early 2026.","url":"https://securityaffairs.com/?p=202050","by":"Security Affairs","patch":null},{"at":"2026-08-19","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"Broadcom revised the advisory to VMSA-2026-0006.2, adding ESX and vCenter 7.0 patch guidance for the critical issues in the same advisory. The advisory does not say whether attacks have been seen.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","by":"Broadcom","patch":null},{"at":"2026-08-03","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"Broadcom revised the advisory to VMSA-2026-0006.1, adding ESX and vCenter 8.0 U2f express patches.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","by":"Broadcom","patch":null},{"at":"2026-07-29","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Broadcom published advisory VMSA-2026-0006, which covers CVE-2026-41709, a low-severity (CVSS 2.7) insufficient logging flaw in VMware ESX, with fixed builds for ESX 9.1, 9.0 and 8.0, VCF 5.2.4 and a Telco Cloud Platform KB. It lists no workarounds.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","by":"Broadcom","patch":"patched"}],"url":"https://hard.fyi/live/broadcom-esx-logging-flaw-exploited-oct-2026/","json":"https://hard.fyi/api/live?id=broadcom-esx-logging-flaw-exploited-oct-2026"}