# VMware ESX logging bypass (CVE-2026-41709) added to CISA KEV: admins can act without being logged · pwn.watch > CISA added CVE-2026-41709, a VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. Broadcom rates it Low (CVSSv3 2.7): a malicious administrator could perform certain operations on ESX without them being logged, which helps an attacker who already has admin access hide activity. Broadcom fixed it in VMSA-2026-0006, first published July 29 2026, and credits Ian Barton of CrowdStrike for reporting it. CrowdStrike's 2026 Legal Threat Landscape Report (Oct 28) says the China-nexus adversary WARP PANDA exploited CVE-2026-41709 as a zero-day in several intrusions, as late as early 2026, while deploying malware in VMware vCenter environments at U.S. entities including legal-sector targets. Page: https://pwn.watch/i/vmware-esx-insufficient-logging-cve-2026-41709-cisa-kev · generated 2026-10-30T01:28:37.639Z ## Status - Severity: medium · status: live · patch: patched - Product: VMware ESX / ESXi (also in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform) - Started: 2026-07-29 - CVEs: CVE-2026-41709 - Affected: VMware ESX 9.1.x, 9.0.x and 8.0 before the fixed builds; VMware Cloud Foundation 5.x before 5.2.4; VMware Telco Cloud Platform ESX 5.0.x, 5.1.x - Fixed in: ESXi-9.1.0.0-25370933 (VCF / vSphere Foundation 9.1.x); ESXi-9.0.2.0100-25595025 (VCF / vSphere Foundation 9.0.x); ESXi80U3j-25429389 (ESX 8.0); VMware Cloud Foundation 5.2.4; Telco Cloud Platform: KB449886 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/vmware-esx-insufficient-logging-cve-2026-41709-cisa-kev/feed.xml - JSON Feed: https://pwn.watch/i/vmware-esx-insufficient-logging-cve-2026-41709-cisa-kev/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/vmware-esx-insufficient-logging-cve-2026-41709-cisa-kev.json - This file: https://pwn.watch/i/vmware-esx-insufficient-logging-cve-2026-41709-cisa-kev/llms.txt ## Updates (newest first) - 2026-10-28: CISA adds CVE-2026-41709 (Broadcom VMware ESX Insufficient Logging Vulnerability) to the KEV catalog, based on evidence of active exploitation. (https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog) - 2026-10-28: CrowdStrike's 2026 Legal Threat Landscape Report says China-nexus adversary WARP PANDA exploited CVE-2026-41709 as a zero-day in several intrusions, as late as early 2026, including at legal-sector targets. (https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/) - 2026-07-29: Broadcom publishes VMSA-2026-0006, which fixes CVE-2026-41709 in ESX along with vCenter, Workstation and Fusion bugs. (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) ## Fix brief # Security brief: VMware ESX logging bypass (CVE-2026-41709) added to CISA KEV: admins can act without being logged Source: https://pwn.watch/i/vmware-esx-insufficient-logging-cve-2026-41709-cisa-kev · status: live · severity: medium · updated Oct 29, 2026, 14:38 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is CISA added CVE-2026-41709, a VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. Broadcom rates it Low (CVSSv3 2.7): a malicious administrator could perform certain operations on ESX without them being logged, which helps an attacker who already has admin access hide activity. Broadcom fixed it in VMSA-2026-0006, first published July 29 2026, and credits Ian Barton of CrowdStrike for reporting it. CrowdStrike's 2026 Legal Threat Landscape Report (Oct 28) says the China-nexus adversary WARP PANDA exploited CVE-2026-41709 as a zero-day in several intrusions, as late as early 2026, while deploying malware in VMware vCenter environments at U.S. entities including legal-sector targets. Severity detail: CVSSv3 2.7 Low from Broadcom (needs admin access), but actively exploited per CISA KEV (Oct 28 2026) - Product: VMware ESX / ESXi (also in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform) - CVE / advisory ids: CVE-2026-41709 ## Affected versions - VMware ESX 9.1.x, 9.0.x and 8.0 before the fixed builds - VMware Cloud Foundation 5.x before 5.2.4 - VMware Telco Cloud Platform ESX 5.0.x, 5.1.x ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - ESXi-9.1.0.0-25370933 (VCF / vSphere Foundation 9.1.x) - ESXi-9.0.2.0100-25595025 (VCF / vSphere Foundation 9.0.x) - ESXi80U3j-25429389 (ESX 8.0) - VMware Cloud Foundation 5.2.4 - Telco Cloud Platform: KB449886 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Update ESX hosts to the fixed builds in VMSA-2026-0006 (ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, or VCF 5.2.4). Because the bug lets an admin act without logs, review who holds ESX admin rights, rotate those credentials if a host may have been exposed, and don't rely only on ESX logs when investigating. ## Latest updates - Oct 28, 2026: CISA adds CVE-2026-41709 (Broadcom VMware ESX Insufficient Logging Vulnerability) to the KEV catalog, based on evidence of active exploitation. - Oct 28, 2026: CrowdStrike's 2026 Legal Threat Landscape Report says China-nexus adversary WARP PANDA exploited CVE-2026-41709 as a zero-day in several intrusions, as late as early 2026, including at legal-sector targets. - Jul 29, 2026: Broadcom publishes VMSA-2026-0006, which fixes CVE-2026-41709 in ESX along with vCenter, Workstation and Fusion bugs. ## Advisories - [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog) (CISA) - [VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) (Broadcom) - [CVE-2026-41709 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-41709) (NVD) ## Write-ups & news - [CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/) - [China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility](https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html) ## Caveats CISA did not say who exploited it or how. CrowdStrike attributes zero-day exploitation to WARP PANDA (also tracked as UNC5221 per The Hacker News), which pivots from edge devices into vCenter and uses the bug to reduce audit-trail visibility. Broadcom credits Ian Barton of CrowdStrike for the report. --- Machine-readable: https://pwn.watch/i/vmware-esx-insufficient-logging-cve-2026-41709-cisa-kev.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.