Skip to content
eastbaycyber

Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

CVE-2026-41709 Exploited to Reduce VMware ESX Audit Visibility

Breaking news 5 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

TL;DR - CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on October 28, 2026. - CISA describes it as an insufficient logging vulnerability in Broadcom VMware ESX. - The flaw can allow an attacker with admin access to perform certain operations without being logged. - The Hacker News reports that CrowdStrike linked exploitation to Warp Panda, a China-nexus threat actor. - CISA lists 2026-11-11 as the due date for the VMware ESX entry.

What happened#

CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on October 28, 2026, citing evidence of active exploitation. CISA identifies the issue as a “Broadcom VMWare ESX Insufficient Logging Vulnerability.” Its catalog entry says the vulnerability could allow a malicious actor with admin access to perform certain operations without being logged. The entry lists CWE-778 and says ransomware use is unknown. CISA’s alert and CISA’s catalog entry provide the government’s listing.

The CISA catalog gives CVE-2026-41709 a date added of 2026-10-28, a due date of 2026-11-11, and says forensic triage is not required per BOD 26-04. The catalog action is to apply mitigations in accordance with vendor instructions and applicable BOD 26-04 guidance. It also says organizations should evaluate each asset’s internet exposure and follow the guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

The Hacker News reports that CrowdStrike identified exploitation of CVE-2026-41709 as a zero-day in early 2026. It reports that the activity was associated with Warp Panda and targeted the U.S. legal sector, with the aim of reducing audit trail visibility. Those details are attributed to CrowdStrike’s 2026 Legal Threat Landscape Report, as described by The Hacker News, rather than to CISA’s catalog entry.

Are you affected#

Organizations may be affected if they operate Broadcom VMware ESX or related products covered by Broadcom’s advisory. Broadcom’s notification identifies VMware Cloud Foundation, VMware Fusion, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform, VMware vCenter Server, VMware vSphere ESXi, VMware vSphere Foundation, and VMware Workstation among the listed products. The notification’s status is OPEN, and it lists CVE-2026-41709 among the affected CVEs. Broadcom’s VMSA-2026-0006.1 notification gives the product and remediation details.

The VMware Telco Cloud response article lists CVE-2026-41709 for VMware Telco Cloud Platform versions 5.0.x and 5.1.x, with ESXi80U3j-25429389 shown as the fixed version. The same article says the vulnerability is not listed for VMware Telco Cloud Infrastructure in that table. Broadcom’s Telco Cloud article contains those details.

CISA’s catalog entry does not state that every VMware installation is affected. Teams should compare their deployed products and versions with Broadcom’s advisory and applicable product-specific guidance.

What is confirmed and what is reported#

Claim Source Status
CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on October 28, 2026. CISA alert Confirmed
CVE-2026-41709 is an insufficient logging vulnerability in Broadcom VMware ESX that could allow a malicious actor with admin access to perform certain operations without being logged. CISA catalog Confirmed
CISA lists 2026-11-11 as the due date for CVE-2026-41709. CISA catalog Confirmed
Broadcom’s notification lists CVE-2026-41709 among vulnerabilities addressed by updates for VMware products. Broadcom notification Reported
The VMware Telco Cloud article lists ESXi80U3j-25429389 as a fixed version for CVE-2026-41709 on VMware Telco Cloud Platform versions 5.0.x and 5.1.x. Broadcom Telco Cloud article Reported
CrowdStrike linked exploitation of CVE-2026-41709 to Warp Panda, a China-nexus threat actor, in attacks targeting the U.S. legal sector. The Hacker News Reported
The activity was intended to reduce audit trail visibility. The Hacker News Reported

What defenders should do now#

  1. Identify VMware ESX and related VMware products in use, then compare deployed versions with Broadcom’s advisory and product-specific guidance.

  2. Prioritize CVE-2026-41709 in vulnerability-management workflows. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize vulnerabilities in the KEV Catalog. CISA’s KEV guidance lists CVE-2026-41709 with a due date of 2026-11-11.

  3. Apply mitigations in accordance with vendor instructions. CISA’s catalog action directs organizations to follow vendor guidance and applicable BOD 26-04 guidance.

  4. Review internet exposure for affected assets. CISA says stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to applicable patching guidance.

  5. Check relevant VMware product documentation, including Broadcom’s VMSA-2026-0006.1 notification and the VMware Telco Cloud response article, for applicable fixed versions and upgrade guidance.

  6. Consider the reported threat activity when reviewing security telemetry around VMware environments. The Hacker News reports that Warp Panda activity included efforts to bypass audit logging, harvest cloud session tokens, and register rogue MFA devices. These details are reported by The Hacker News from CrowdStrike’s report and are not described in CISA’s catalog entry.

  7. For Federal Civilian Executive Branch agencies, follow the applicable BOD 26-04 requirements and the 2026-11-11 due date listed by CISA. CISA says BOD 26-04 applies only to FCEB agencies, while encouraging all organizations to use the KEV Catalog for prioritization.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

Last verified: 2026-10-29

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.