Exploit / PoChighExploited in the wild

Canada updates VMware advisory after two CVEs enter CISA KEV

Original title: VMware security advisory (AV26-763) – Update 2

Canadian Centre for Cyber SecurityOct 28, 2026 · 19:53 UTC (2d ago)1 min read2

Part of a story covered by 9 sourcesCISA lists exploited VMware ESX logging flaw; federal fixes due November 11Merged summary & timeline

AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.

The Canadian Centre for Cyber Security issued Update 2 to AV26-763, covering VMware Cloud Foundation, ESX, Fusion, Workstation, vCenter, vSphere Foundation and Telco Cloud products. VMSA-2026-0006 addresses CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703 and CVE-2026-41709. CISA has added CVE-2026-41709 and CVE-2026-59310 to the Known Exploited Vulnerabilities catalog. The centre urges administrators to review the linked advisories and apply updates as they become available.

Unconfirmed: The advisory does not describe each CVE's impact or how the two KEV entries are being exploited.

Key facts

Update 2 is dated October 28, 2026; the original advisory is July 30.
ESX builds listed as prior-to include ESXi-9.0.2.0100-25595025 and ESXi80U3k-25595708.
vCenter builds cited as prior to 8.0 U3k, 9.0.2.0100 and 9.1.0.0300.
Fusion and Workstation are listed as prior to 26H1.

Security assessment · AI, from the articleExploited in the wild

Impact: Two VMware CVEs are confirmed exploited; other impacts unstated

Product	Affected
VMware Cloud Foundation	5.x, 9.0.x.x, 9.1.x.x, prior to 5.2.3
VMware ESX	Prior to ESXi-9.0.2.0100-25595025, ESXi-9.1.0.0-25370933, ESXi-9.1.0.0200-25557999, ESXi80U3i-25205845 and ESXi80U3k-25595708
VMware vCenter	Prior to 8.0 U3k, 9.0.2.0100 and 9.1.0.0300
VMware Fusion	Prior to 26H1
VMware Workstation	Prior to 26H1

What to do

1.Review VMSA-2026-0006 and apply the listed product updates.
2.Prioritize CVE-2026-41709 and CVE-2026-59310 because both are in CISA KEV.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-59309 CVE-2026-59310 CVE-2026-47876 CVE-2026-41703 CVE-2026-41709

Tags: vmware esxi vcenter cisa-kev cloud-foundation

Vendors: VMware
Products: Cloud Foundation ESX Fusion Workstation vCenter vSphere Foundation Telco Cloud Infrastructure Telco Cloud Platform
Organizations: Canadian Centre for Cyber Security CISA

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-41703	VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability	7.6	<1%		Jul 30, 2026
CVE-2026-41709	Insufficient logging in VMware ESX for admin operations	2.7	<1%	KEV	Jul 30, 2026 KEV Oct 28, 2026
CVE-2026-47876	VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter	9.3	<1%		Jul 30, 2026
CVE-2026-59309	VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service	9.8	8%		Jul 30, 2026
CVE-2026-59310	Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog	9.8	3%	KEVRansomwarePoC ×2	Jul 30, 2026 KEV Aug 18, 2026

From the original article

1 min read at cyber.gc.ca

Serial number: AV26-763 Date: July 30, 2026 Updated: October 28, 2026 As of July 30, 2026, VMware is affected by vulnerabilities in the following products: Cloud Foundation 5. x 9. 0.

Canadian Centre for Cyber Security

cyber.gc.ca

Read the full article at Canadian Centre for Cyber Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.