NewsCompaniesFlawsGuides
Get the app
LowFixedBeing used in attacksUpdated

Broadcom VMware ESX logging flaw CVE-2026-41709 used in attacks; fixed builds available

A low-rated Broadcom VMware ESX flaw (CVE-2026-41709) that lets an admin act without leaving logs is now on CISA's exploited list. Mainly a business issue: if you run ESX 8.0, 9.0 or 9.1, install the July builds. No workaround exists.

What to do

If you run VMware ESX, install the fixed build for your version (9.1, 9.0 or 8.0, or VCF 5.2.4) and ask your IT provider to confirm. Families with no VMware servers have nothing to do.

What’s happening

CVE-2026-41709 is an insufficient logging flaw in Broadcom's VMware ESX hypervisor, the software that runs virtual servers in data centres. Someone who already has administrator access could carry out certain actions without them being recorded in the logs. Broadcom rated it low severity (CVSS 2.7) and published fixes on 29 July 2026 in advisory VMSA-2026-0006: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, VMware Cloud Foundation 5.2.4, and a knowledge-base article for Telco Cloud Platform. Broadcom lists no workaround and its advisory does not say whether attacks have been seen. On 28 October 2026 CISA added the flaw to its list of exploited vulnerabilities, with a federal deadline of 11 November. Press reports, which HARD could not check against the original, attribute the exploitation to CrowdStrike, which says a China-linked group called Warp Panda used it as a zero-day in early 2026, including against US law firms, to reduce audit trail visibility. Sources disagree on whether ESXi 7.0 has a fix for this flaw. It is a business and data-centre issue, not a home one.

What
Flaw
Affects
Broadcom VMware ESX (ESXi) hypervisor and VMware Cloud Foundation
Affected
VMware ESX 9.1.x (VCF/VSF)
VMware ESX 9.0.x (VCF/VSF)
VMware ESX 8.0
VMware Cloud Foundation 5.x
Telco Cloud Platform 5.0.x and 5.1.x
Fixed in
ESXi-9.1.0.0-25370933
ESXi-9.0.2.0100-25595025
ESXi80U3j-25429389
VMware Cloud Foundation 5.2.4
Telco Cloud Platform: KB449886
CVE
CVE-2026-41709
Since
28 Oct 2026

Timeline

  1. CISA added

    CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalogue, with a federal agency deadline of 11 November 2026. News reports link this to CrowdStrike's finding that a China-linked group, Warp Panda, used the flaw as a zero-day in early 2026.

  2. Vendor revised

    Broadcom revised the advisory to VMSA-2026-0006.2, adding ESX and vCenter 7.0 patch guidance for the critical issues in the same advisory. The advisory does not say whether attacks have been seen.

  3. Vendor revised

    Broadcom revised the advisory to VMSA-2026-0006.1, adding ESX and vCenter 8.0 U2f express patches.

  4. Made publicFixed

    Broadcom published advisory VMSA-2026-0006, which covers CVE-2026-41709, a low-severity (CVSS 2.7) insufficient logging flaw in VMware ESX, with fixed builds for ESX 9.1, 9.0 and 8.0, VCF 5.2.4 and a Telco Cloud Platform KB. It lists no workarounds.

Sources

  1. VMSA-2026-0006.2: VMware ESX security advisoryBroadcom · 19 Aug 2026
  2. CISA adds Linux Kernel and Broadcom VMware ESX flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 28 Oct 2026
  3. Chinese hackers quietly used low-severity ESXi logging flaw as zero-daySecurityWeek · 29 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS