VMware ESXi

Mentions · 7d5
Mentions · 30d6
All mentions9
First seenAug 31, 2026
Last mentioned1d ago

Timeline

9 articles · newest first

CISA adds VMware ESX and Linux kernel flaws to KEV

Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.

Security Affairsupdated Oct 29, 16:25 UTC · 1d agofirst Oct 29, 16:05 UTC · 1d agoExploit / PoCExploited9 sourcesCVE-2026-41709 CVE-2026-463001

WARP PANDA used VMware ESXi zero-day against US law firms

CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.

GBHackersupdated Oct 29, 16:25 UTC · 1d agofirst Oct 29, 12:30 UTC · 1d agoThreat actorExploited9 sourcesCVE-2026-417091

CISA adds exploited VMware ESXi logging flaw CVE-2026-41709 to KEV

Federal remediation is due November 11, 2026; the CVSS 2.7 flaw only hides actions by someone who already has admin rights.

GBHackersupdated Oct 29, 16:25 UTC · 1d agofirst Oct 29, 08:30 UTC · 2d agoExploit / PoCExploited9 sourcesCVE-2026-417091

Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day

CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.

SecurityWeekupdated Oct 29, 16:25 UTC · 1d agofirst Oct 29, 08:01 UTC · 2d agoExploit / PoCExploited9 sourcesCVE-2026-41709 CVE-2026-59309 CVE-2026-593101

CISA lists exploited VMware ESX logging flaw CVE-2026-41709

An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.

Cyber Security Newsupdated Oct 29, 16:25 UTC · 1d agofirst Oct 29, 06:22 UTC · 2d agoExploit / PoCExploited9 sourcesCVE-2026-417091

Police Target KillSec Ransomware Group with Arrests and Seizures

European police seized KillSec infrastructure and arrested suspects, including a 16-year-old alleged ringleader.

Infosecurity MagazineOct 2, 09:20 UTC · 28d agoPolicy & legal4

Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS

New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.

Cyber Security NewsSep 8, 09:10 UTC · Sep 8, 2026RansomwareExploited1

Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets

Aurora ransomware operators used Cursor AI running Claude Sonnet to plan and execute intrusions against dozens of organizations in nine countries.

The Hacker NewsAug 31, 11:47 UTC · Aug 31, 2026RansomwareExploited15 · 3 reads

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

The Hacker NewsAug 31, 09:04 UTC · Aug 31, 2026Threat actorExploited2

Related CVEs

by mentions

CVE-2026-41709<1%2.7
Insufficient logging in VMware ESX for admin operations
published Jul 30, 2026Broadcom VMware ESXKEV
CVE-2026-593103%9.8
Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
published Jul 30, 2026Broadcom (VMware) vCenter ServerKEVRansomwarePoC ×2
CVE-2026-4630016%7.8
Shared-frag marker loss in Linux kernel skb coalescing (LPE)
published May 23, 2026linux kernelKEVPoC
CVE-2026-593098%9.8
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service
published Jul 30, 2026vmware vcenter server

Appears with

VMwarevendor · 5
Broadcomvendor · 4
CISAorganization · 4
CrowdStrikeorganization · 4
Warp Pandathreat actor · 3
VMware vCenterproduct · 3
vSphere Foundationproduct · 2
VMware Cloud Foundationproduct · 2
vCenterproduct · 2
BrickStormmalware · 2
Claude Sonnetproduct · 1
UNC3886threat actor · 1
Windowsproduct · 1
Aurorathreat actor · 1
OVERCAST PANDAthreat actor · 1
Teckentrupvictim · 1

Entities are extracted by the model from each article. First seen Aug 31, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.