Low-scored VMware ESXi logging flaw was exploited as a zero-day, now on CISA's KEV list

In brief

Developing. Last updated 29 October 2026, 13:05 Dubai time (UTC+4).

CISA added CVE-2026-41709, a VMware ESXi flaw, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October and gave US federal civilian agencies until 11 November to act. Broadcom scores the flaw only 2.7, but CrowdStrike says a China-nexus group exploited it as a zero-day.

What the flaw is

Broadcom's advisory, VMSA-2026-0006, first published on 29 July 2026, describes an "insufficient logging vulnerability" in ESX. It says: "A malicious administrator could exploit this issue to perform certain operations without them being logged." Broadcom rates it Low, with a CVSS v3 base score of 2.7, and credits Ian Barton of CrowdStrike with reporting it. CISA's entry says the same in plain terms: an actor "with admin access" can "perform certain operations without being logged".

The flaw does not give anyone access by itself. The attacker must already have admin rights.

Who used it

In its 2026 Legal Threat Landscape Report, published on 28 October, CrowdStrike says WARP PANDA, a China-nexus adversary, carried out "multiple intrusions at U.S.-based entities", including some in the legal sector, and deployed malware in victims' VMware vCenter environments. "In several of these cases, and as late as early 2026," CrowdStrike says, the group exploited CVE-2026-41709 "as a zero-day".

Neither CISA nor CrowdStrike has published victim counts, indicators of compromise or the specific operations hidden from logs. CISA's entry lists ransomware use as "Unknown".

What to patch

Broadcom lists these fixed versions for CVE-2026-41709:

• ESX 9.1.x (VCF and vSphere Foundation): ESXi-9.1.0.0-25370933
• ESX 9.0.x: ESXi-9.0.2.0100-25595025
• ESX 8.0: ESXi80U3j-25429389
• VMware Cloud Foundation 5.x: 5.2.4
• Telco Cloud Platform 5.0.x and 5.1.x: see Broadcom KB449886

Broadcom lists no workaround. The same advisory also fixes critical vCenter and ESX flaws, so the update is worth doing for other reasons too.

What to check

Neither Broadcom nor CISA has published log checks specific to this flaw, so ByteNib is not suggesting any. CISA's KEV entry points agencies to its BOD 26-04 "Forensics Triage Requirements", although it marks this flaw "No" in its forensic-triage column.

Why it matters

A 2.7 score usually sends a patch to the bottom of the queue. The score measures what the flaw gives an attacker on its own, which is little. By Broadcom's description, the flaw's value to an intruder who already has admin access is that some actions go unlogged, and CrowdStrike says that is how it was used in real intrusions. Because the flaw was exploited as a zero-day before Broadcom's 29 July fix, teams investigating any ESXi host that ran unpatched builds, before or after July, should not assume its logs are complete.

Sources and scope

• CISA: Known Exploited Vulnerabilities catalog (CSV, CVE-2026-41709 entry)
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (28 October 2026)
• Broadcom: VMSA-2026-0006
• CrowdStrike: Inside the CrowdStrike 2026 Legal Threat Landscape Report
• SecurityWeek: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
• The Hacker News: China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

CISA's catalog entry, Broadcom's advisory and CrowdStrike's report summary were read in full; CrowdStrike's full PDF report is gated and was not read. SecurityWeek and The Hacker News were used for context only. This article includes no exploit details. The "Why it matters" section is ByteNib editorial analysis. This article was researched and drafted with AI assistance and edited under ByteNib's editorial standards.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.