Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

CISA Adds VMware ESX Logging Flaw to KEV Catalog

7 sources · 8 articlesFirst reported Updated ()
What's new

October 29 reports add exploitation of CVE-2026-59309 and CVE-2026-59310, Linux kernel Fragnesia CVE-2026-46300 chaining, and Dream firewall rooting report.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA added CVE-2026-41709 to KEV on October 28 after China-linked Warp Panda exploited the VMware ESXi insufficient-logging flaw as a zero-day against US law firms.

China-nexus group WARP PANDA exploited Broadcom VMware ESX insufficient-logging flaw CVE-2026-41709 in early 2026 to bypass audit trails after gaining vCenter access, targeting US law firms and other organizations. The flaw lets an admin perform operations without logging them and does not grant initial access. Broadcom fixed it in July 2026 builds including ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, and ESXi-9.1.0.0-25370933. CISA added it to KEV on October 28 with a November 11 federal remediation deadline; ransomware use is unknown.

Key facts
  • CVE-2026-41709 CVSS 2.7 CWE-778 insufficient logging in VMware ESX
  • Fixed in July 2026 ESXi builds 9.1.0.0-25370933, 9.0.2.0100-25595025, 80U3j-25429389
  • WARP PANDA used as zero-day after vCenter access against US law firms
  • CISA KEV addition October 28, 2026; FCEB deadline November 11, 2026
  • Does not enable initial access or admin rights
  • Related CVEs CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703 also exploited
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026CISA adds CVE-2026-41709 to KEV catalog · Cyber Security News
  2. Oct 28, 2026CISA sets November 11 remediation deadline for federal agencies · The Hacker News
  3. Oct 29, 2026CrowdStrike attributes zero-day exploitation to WARP PANDA against US law firms · SecurityWeek
  4. Oct 29, 2026Security Affairs and Help Net Security report on related Linux kernel CVE-2026-46300 and chaining · Security Affairs

What each outlet adds

beyond the shared facts
  • Canadian Centre for Cyber SecurityLists Update 2 to AV26-763 and multiple related CVEs including 59309 and 59310
  • The Hacker NewsMandiant link to BeyondTrust CVE-2026-102764 and Warp Panda malware details
  • Security AffairsLinux kernel Fragnesia CVE-2026-46300 and chaining with PHP2Shell flaws
  • Help Net SecurityDream report on chaining to root 25 firewalls and Cisco firewall CVE-2026-76418
  • Cyber Security NewsCredit to CrowdStrike researcher Ian Barton and specific fixed ESXi builds
CVEs
CVE-2026-41709CVE-2026-46300CVE-2026-109618CVE-2026-109619CVE-2026-76418CVE-2026-59309CVE-2026-59310CVE-2026-47876CVE-2026-41703
Vendors
BroadcomCiscoPalo Alto NetworksVMware
Products
VMware ESXVMware vCenterLinux kernelVMware ESXiVMware WorkstationVMware FusionCloud FoundationESXFusionWorkstationvCentervSphere Foundation
Threat actors
Warp PandaWARP PANDATITAN PANDAMURKY PANDAOVERCAST PANDAArmory CastleClay TyphoonVerdantBamboo
Malware
BRICKSTORMSharpStormBrickStormTetanusStormDualGaugeGuestConduit
Organizations
CrowdStrikeCISADreamQuirsoCanadian Centre for Cyber SecurityWizMandiant
Countries
ChinaUnited StatesJapanTaiwanSouth KoreaUnited Kingdom

Coverage

oldest first · one row per article · UTC
  1. · 6d ago Canadian Centre for Cyber SecurityFirst report

    Canada updates VMware advisory after two CVEs enter CISA KEV

    CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.

  2. · 6d ago The Hacker News

    CISA lists VMware ESX logging flaw exploited by Warp Panda

    CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.

  3. · 6d ago Cyber Security News

    CISA lists exploited VMware ESX logging flaw CVE-2026-41709

    An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.

  4. · 5d ago SecurityWeek

    Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day

    CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.

  5. · 5d ago GBHackers

    CISA adds exploited VMware ESXi logging flaw CVE-2026-41709 to KEV

    Federal remediation is due November 11, 2026; the CVSS 2.7 flaw only hides actions by someone who already has admin rights.

  6. · 5d ago GBHackers

    WARP PANDA used VMware ESXi zero-day against US law firms

    CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.

  7. · 5d ago Security Affairs

    CISA adds VMware ESX and Linux kernel flaws to KEV

    Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.

  8. · 5d ago Help Net Security

    Warp Panda used VMware ESX zero-day; firewalls rooted and crashed

    CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
+1 related CVE
CVE-2026-109619
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV
CVE-2026-41703
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability
7.6<1%
CVE-2026-41709
Insufficient logging in VMware ESX for admin operations
2.7<1%KEV
KEV
CVE-2026-46300
Shared-frag marker loss in Linux kernel skb coalescing (LPE)
7.816%KEVPoC
KEV
CVE-2026-47876
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter
9.3<1%
CVE-2026-59309
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service
9.88%
CVE-2026-59310
Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
9.83%KEVRansomwarePoC ×2
KEV
CVE-2026-76418
Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
8.6<1%KEV
KEV