CISA Adds VMware ESXi Logging Flaw to KEV Catalog
First merged summary.
China-linked Warp Panda exploited VMware ESX zero-day CVE-2026-41709 to hide logs; CISA added it to KEV on October 28 with federal patch deadline November 11, 2026.
CISA added CVE-2026-41709, an insufficient-logging flaw in Broadcom VMware ESX rated CVSS 2.7, to its Known Exploited Vulnerabilities catalog on October 28, 2026. The flaw lets an administrator perform operations without expected log records after gaining admin access. CrowdStrike attributes early 2026 intrusions targeting US law firms and other organizations to China-nexus group Warp Panda, which used the zero-day after initial vCenter access. Broadcom fixed it in July 2026 ESXi builds; no workaround is available and ransomware use is unknown.
- CVE-2026-41709 CVSS 2.7, CWE-778
- Fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389
- Warp Panda also tracked as Armory Castle, Clay Typhoon, VerdantBamboo
- Federal agencies deadline November 11, 2026
- Exploited after vCenter access with malware like BRICKSTORM
Timeline
dated events in the reporting · oldest first- Aug 31, 2026CrowdStrike window for Warp Panda legal sector activity ends · GBHackers
- Oct 28, 2026CISA adds CVE-2026-41709 to KEV catalog · Cyber Security News
- Oct 29, 2026CISA sets November 11, 2026 federal remediation deadline · GBHackers
- Oct 30, 2026CrowdStrike reports Vapor Panda ARTEX activity · CSO Online
What each outlet adds
beyond the shared facts- SecurityWeekDetails CVE-2026-59309 and CVE-2026-59310 also exploited by same group
- The Hacker NewsMandiant links Warp Panda to BeyondTrust CVE-2026-102764
- GBHackersWarp Panda stole cloud tokens and rogue MFA devices
- Help Net SecurityWarp Panda chained with PHP2Shell flaws and rooted firewalls
- CVEs
- CVE-2026-41709CVE-2026-46300CVE-2026-109618CVE-2026-109619CVE-2026-76418CVE-2026-59309CVE-2026-59310
- Products
- VMware ESXVMware vCenterLinux kernelVMware ESXiVMware WorkstationVMware FusionIntapp Time ServervCenterWorkstationFusionVMware Cloud FoundationVMware vSphere Foundation
- Threat actors
- Vapor PandaEarth EstriesHollow PandaOvercast PandaTitan PandaVeiled PandaWarp PandaWARP PANDATITAN PANDAMURKY PANDAOVERCAST PANDAArmory Castle
- Malware
- ARTEXBLOODALCHEMYShadowPadFlowCloudBRICKSTORMSharpStormBrickStormTetanusStormDualGaugeGuestConduit
- AI models
- DeepSeek
Coverage
oldest first · one row per article · UTC- · 13d ago
The Hacker NewsFirst report
CISA lists VMware ESX logging flaw exploited by Warp Panda
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
- · 13d ago
Cyber Security News
CISA lists exploited VMware ESX logging flaw CVE-2026-41709
An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
| CVE-2026-59309 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service | 9.8 | 8% | ||
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 62% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |