Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
CVE-2026-41709
Insufficient logging in VMware ESX for admin operations
CISA: Broadcom VMWare ESX Insufficient Logging Vulnerability
- CVSS 3.1
- 2.7 low
- EPSS
- <1%p53
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
VMware ESX does not log certain operations. A malicious administrator on the network can perform those operations without a log record, weakening integrity of the audit trail. No user interaction is required. Broadcom VMware ESX is affected; affected builds are not listed.
What to do: Apply Broadcom’s mitigations for CVE-2026-41709 per vendor instructions and CISA BOD 26-04. If mitigations are unavailable, discontinue use of the product.
| Product | Affected |
|---|---|
| Broadcom VMware ESX | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
KEVCISA Known Exploited Vulnerability
- Affected
- Broadcom VMware ESX
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
In the news
12 storiesCISA adds VMware ESX and Linux kernel flaws to KEV
CVE-2026-41709 and CVE-2026-46300 are actively exploited; BOD 26-04 requires FCEB agencies to prioritize them.
80
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
80
Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
78
Canada updates VMware advisory after two CVEs enter CISA KEV
CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.
78
WARP PANDA used VMware ESXi zero-day against US law firms
CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.
76
CISA adds VMware ESX and Linux kernel flaws to KEV
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
74
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
74
CISA adds exploited VMware ESXi logging flaw CVE-2026-41709 to KEV
Federal remediation is due November 11, 2026; the CVSS 2.7 flaw only hides actions by someone who already has admin rights.
68
CISA KEV: VMware ESX logging flaw CVE-2026-41709 exploited
An attacker who already has admin access can perform certain ESX operations without them being logged; due November 11.
64
CISA lists exploited VMware ESX logging flaw CVE-2026-41709
An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.
62
60