Medium 2.7Being exploited
Broadcom · VMware ESX (ESXi) · CVE-2026-41709
VMware ESX logging flaw used as a zero-day to hide attackers' tracks
A flaw in VMware ESX lets someone who already has administrator access carry out certain actions without them being logged. Broadcom rates it low (CVSS 2.7), but CrowdStrike reports the China-linked group Warp Panda used it as a zero-day to cut audit trail visibility in intrusions at US organisations, including law firms. CISA added it to its Known Exploited Vulnerabilities list on 28 October.
- Affected
- VMware ESX 8.0 and 9.0 and 9.1 builds before the fixes, plus VMware Cloud Foundation 5.x and Telco Cloud Platform 5.x, per Broadcom advisory VMSA-2026-0006.
- What to do
- Apply the fixed versions in the advisory's response matrix: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 for ESX 8.0, and 5.2.4 for VMware Cloud Foundation 5.x. Broadcom lists no workaround. The same advisory also covers critical vCenter flaws already attacked, so patch those too.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
- Why it’s here
- Exploited as a zero-day; on CISA's KEV list; ESX is a very common hypervisor. Low score, but it helps attackers stay hidden.