ESXi CVE-2026-41709: KEV logging gap used as zero-day

ESXi CVE-2026-41709: KEV logging gap used as zero-day

Home » Alert » ESXi CVE-2026-41709: KEV logging gap used as zero-day

ALERT · Actively exploited. Last updated 29 October 2026. See the Alert Tracker

If you run VMware ESXi or VMware Cloud Foundation, treat CVE-2026-41709 as a priority patch. CISA added it to KEV on 28 October 2026 (due 11 November). CrowdStrike reports the China-nexus group Warp Panda used it as a zero-day against US legal-sector targets as late as early 2026. The flaw does not grant access on its own; it hides admin activity that should have been logged.

What it is

Pulp illustration of a warning robot beside a server rack whose audit log scroll is torn blank

Broadcom’s VMSA-2026-0006 advisory (opens in a new tab) describes CVE-2026-41709 as an insufficient logging vulnerability in VMware ESX. Severity is Low, CVSS 3.1 base score 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N). A malicious administrator can perform certain operations without them being logged. Broadcom credits Ian Barton of CrowdStrike for the report. NVD carries the same description and fixed builds.

Who is affected

Pulp illustration of riveted server racks under a glass dome with a warning robot in the aisle

VMware ESX 8.0, 9.0.x and 9.1.x, plus VMware Cloud Foundation / vSphere Foundation builds that ship those ESX trains, and VCF 5.x before 5.2.4. Broadcom’s fixed builds include ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, ESXi-9.1.0.0-25370933 and VCF 5.2.4. Confirm your build ID before closing the ticket.

Exploitation status

Pulp illustration of a shadowed figure near a vault door with a lit warning beacon

CISA listed CVE-2026-41709 in the Known Exploited Vulnerabilities catalogue (opens in a new tab) on 28 October 2026 (catalogue 2026.10.28; due 11 November; ransomware use Unknown). FIRST EPSS on 28 October was about 0.003 — low as a mass-exploit probability score, which matches a post-compromise visibility gap rather than an internet worm.

CrowdStrike’s 2026 Legal Threat Landscape Report (opens in a new tab) (28 October) says Warp Panda deployed malware in victims’ VMware vCenter environments in multiple US intrusions that included the legal sector, and that in several of those cases, as late as early 2026, the adversary exploited this ESXi command-logging bypass as a zero-day. Treat that as a campaign attribution from CrowdStrike’s own reporting, not as a Broadcom exploit write-up.

Fix and mitigation

Pulp illustration of a warning robot fitting a chrome patch plate onto a cracked server chassis

Apply Broadcom’s fixed builds: ESXi 8.0 U3j (ESXi80U3j-25429389) or later, ESXi-9.0.2.0100-25595025 or later, ESXi-9.1.0.0-25370933 or later, and VCF 5.2.4 where you run that train. Broadcom lists no workaround. Forward ESXi and vCenter syslog off-box so a compromised host cannot erase the only copy. Restrict ESXi shell and SSH to jump hosts, and review admin accounts that can reach the hypervisor management plane.

How to hunt

Pulp illustration of a warning robot reading parallel ticker tapes with one stream abruptly blank

Hunt for gaps, not for a payload signature. Inventory ESXi builds below the fixed IDs above. Baseline daily volume of ESXi audit and shell syslog from each host, and alert on unexpected silence. Correlate shell or busybox activity with missing authentication events in the same window. Companion Hunt Lab package (experimental, untested): in Hunt Lab (opens in a new tab).

Sources

Pulp illustration of a warning robot filing sealed brass document cylinders into a vault drawer

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)