CISA lists exploited VMware ESX logging flaw; federal fixes due November 11
October 29 reports added CrowdStrike’s Warp Panda zero-day attribution plus conflicting CVSS scores and July advisory dates already captured here.
CISA added exploited VMware ESX logging bug CVE-2026-41709; agencies must apply Broadcom’s July fixes by November 11, 2026.
CISA added Broadcom VMware ESX CVE-2026-41709 to the Known Exploited Vulnerabilities catalog on October 28, 2026, with a federal remediation deadline of November 11. An administrator can perform certain operations without expected logs; the flaw does not grant access or privileges. Most outlets cite CVSS 2.7; Security Affairs reports 7.6. According to CrowdStrike, China-nexus Warp Panda used it as a zero-day in early 2026 against U.S. law firms after reaching vCenter. Broadcom’s July builds cover Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud products and offer no workaround. Ransomware use is unknown. SecurityWeek dates the advisories July 29; the Canadian Centre says July 30. GBHackers says BOD 26-04 does not require forensic triage; CISA cites forensics triage guidance.
- CVE-2026-41709 is insufficient logging (CWE-778) requiring existing admin access.
- Fixed ESXi builds include 9.1.0.0-25370933, 9.0.2.0100-25595025, and 80U3j-25429389.
- Cloud Foundation 5.x customers are directed to 5.2.4; no workaround is offered.
- CrowdStrike credits Ian Barton and tracks Warp Panda as Armory Castle, Clay Typhoon, and VerdantBamboo.
- CISA lists ransomware campaign use as unknown.
Timeline
dated events in the reporting · oldest first- Jul 29, 2026Broadcom issued the ESXi advisories containing the logging fix. · SecurityWeek
- Jul 30, 2026Canadian Centre dates the original VMware advisory. · Canadian Centre for Cyber Security
- Oct 28, 2026CISA added CVE-2026-41709 to the KEV catalog. · CISA
- Nov 11, 2026Federal agencies must apply vendor mitigations. · CISA
What each outlet adds
beyond the shared facts- The Hacker NewsNames Warp Panda aliases and July fixes for four product lines.
- Cyber Security NewsCredits CrowdStrike’s Ian Barton and lists Telco Cloud KB449886.
- SecurityWeekDates the advisories July 29 and says attackers reached vCenter.
- GBHackersSays BOD 26-04 does not require forensic triage.
- Security AffairsReports CVSS 7.6 rather than 2.7.
Coverage
oldest first · one row per article · UTC- · 2d ago
CISA Known Exploited VulnerabilitiesFirst report
CISA KEV: VMware ESX logging flaw CVE-2026-41709 exploited
An attacker who already has admin access can perform certain ESX operations without them being logged; due November 11.
- · 2d ago
Canadian Centre for Cyber Security
Canada updates VMware advisory after two CVEs enter CISA KEV
CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.
- · 1d ago
The Hacker News
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
- · 1d ago
Cyber Security News
CISA lists exploited VMware ESX logging flaw CVE-2026-41709
An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.
- · 1d ago
SecurityWeek
Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
- · 1d ago
GBHackers
CISA adds exploited VMware ESXi logging flaw CVE-2026-41709 to KEV
Federal remediation is due November 11, 2026; the CVSS 2.7 flaw only hides actions by someone who already has admin rights.
- · 1d ago
WARP PANDA used VMware ESXi zero-day against US law firms
CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.
- · 1d ago
Security Affairs
CISA adds VMware ESX and Linux kernel flaws to KEV
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
- · 1d ago
Help Net Security
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-41703 | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability | 7.6 | <1% | ||
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
| CVE-2026-47876 | VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter | 9.3 | <1% | ||
| CVE-2026-59309 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service | 9.8 | 8% | ||
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |