VMware ESX logging bypass (CVE-2026-41709) added to CISA KEV: admins can act without being logged

CISA added CVE-2026-41709, a VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. Broadcom rates it Low (CVSSv3 2.7): a malicious administrator could perform certain operations on ESX without them being logged, which helps an attacker who already has admin access hide activity. Broadcom fixed it in VMSA-2026-0006, first published July 29 2026, and credits Ian Barton of CrowdStrike for reporting it. CrowdStrike's 2026 Legal Threat Landscape Report (Oct 28) says the China-nexus adversary WARP PANDA exploited CVE-2026-41709 as a zero-day in several intrusions, as late as early 2026, while deploying malware in VMware vCenter environments at U.S. entities including legal-sector targets.

Why this severity: CVSSv3 2.7 Low from Broadcom (needs admin access), but actively exploited per CISA KEV (Oct 28 2026)

Started

Jul 29, 2026

CVE

CVE-2026-41709

• VMware
• #ESXi
• Broadcom
• CISA KEV
• #Exploited
• #Logging
• Zero-day
• #CrowdStrike
• #WARP PANDA
• #China-nexus

Notes & caveats

CISA did not say who exploited it or how. CrowdStrike attributes zero-day exploitation to WARP PANDA (also tracked as UNC5221 per The Hacker News), which pivots from edge devices into vCenter and uses the bug to reduce audit-trail visibility. Broadcom credits Ian Barton of CrowdStrike for the report.