CVE-2026-41709: VMware ESX Logging Flaw Added to CISA KEV After Warp Panda Used It to Hide Activity
A VMware ESX logging flaw scored 2.7 out of 10 is now on CISA KEV. CrowdStrike says the China-nexus group Warp Panda used it as a zero-day to perform admin operations without being logged. Here is who is affected, the fixed builds, and what to do.
A VMware ESX bug rated 2.7 out of 10 is now on CISA's Known Exploited Vulnerabilities (KEV) list. CVE-2026-41709 is an insufficient logging flaw, and by CVSS standards it barely registers. CISA added it on October 28, 2026, the same day CrowdStrike published its 2026 Legal Threat Landscape Report, which says the China-nexus group it tracks as WARP PANDA exploited the flaw as a zero-day, as late as early 2026, in intrusions at US organizations that included law firms.
The flaw does not get an attacker in. It lets someone who already has administrator access on an ESX host perform certain operations without those operations being logged. That is exactly why it was worth using: it makes the rest of an intrusion harder to see.
What happened
Broadcom published advisory VMSA-2026-0006 on July 29, 2026. It covers five CVEs across ESX, vCenter, Workstation and Fusion, with an overall severity of Critical. CVE-2026-41709 is the mildest of them, rated Low with a CVSS 3.1 score of 2.7, and Broadcom credits Ian Barton of CrowdStrike for reporting it. The advisory says nothing about exploitation.
On October 28, CrowdStrike's report placed it inside a real attack chain. In several intrusions at US-based entities, including targets in the legal sector, WARP PANDA deployed malware in victims' VMware vCenter environments. CrowdStrike says that in several of those cases, as late as early 2026, the group exploited what it calls an "ESXi command logging bypass" (CVE-2026-41709) as a zero-day. That is months before the July patch existed. SecurityWeek and THN, which covered the report, describe the goal as reducing audit-trail visibility. CISA added the CVE to KEV the same day, with a November 11, 2026 due date for federal agencies.
For background, CrowdStrike's earlier WARP PANDA research from December 2025 describes the group gaining initial access through internet-facing edge devices and then moving into vCenter using valid credentials or vCenter vulnerabilities. Neither Broadcom nor CrowdStrike has said which operations go unlogged or how the bypass works.
The flaw and who is affected
The weakness is classified as CWE-778, insufficient logging. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N: reachable over the network with low complexity, but high privileges are required, and the impact is limited to low integrity. Broadcom's description of the attack is one sentence: a malicious administrator could perform certain operations without them being logged. Broadcom lists no workaround.
The vulnerable component is ESX only. vCenter, Workstation and Fusion are not listed for this CVE. Broadcom's response matrix gives these fixes:
Product | Fixed in |
|---|---|
VMware Cloud Foundation / vSphere Foundation 9.1.x.x | ESXi-9.1.0.0-25370933 |
VMware Cloud Foundation / vSphere Foundation 9.0.x.x | ESXi-9.0.2.0100-25595025 |
VMware ESX 8.0 | ESXi80U3j-25429389 |
VMware Cloud Foundation 5.x | 5.2.4 |
VMware Telco Cloud Platform 5.0.x, 5.1.x | KB449886 |
ESX 7.0 does not appear in the matrix for this CVE.
A low score doing a high-stakes job
A list sorted by severity puts this CVE near the bottom, which makes it the one most likely to wait. CVSS scores the flaw as it behaves alone: it needs admin rights and changes little by itself. The attackers valued what it did for everything else. A logging gap on a hypervisor makes later activity on that host harder to reconstruct, and it only helps once an intruder already holds admin access.
The usual signals said very little. The score is 2.7, EPSS sits at 0.3%, and there was no KEV entry until October 28, about 90 days after the CVE was published on July 30. CrowdStrike's account puts real exploitation earlier still, in early 2026.
The flaw also arrived in good company. VMSA-2026-0006 includes three Critical bugs, and SecurityWeek reports that two of them, the vCenter issues CVE-2026-59309 and CVE-2026-59310, have also been exploited. The sensible unit of work is the whole advisory, not the lowest-scored line in it.
Reading it on VulnTracker
The record for CVE-2026-41709 puts the score and the exploitation signals side by side. CVSS 3.1 is 2.7 Low, EPSS is 0.3%, the weakness is CWE-778, and SSVC reads Active, Not automatable, Partial impact. The KEV panel shows the entry added on October 28, 2026 with a due date of November 11, 2026, and NVD status is still Undergoing analysis.
The affected-products view covers four products from one vendor: Cloud Foundation, ESX, Telco Cloud Platform and vSphere Foundation. Fixed versions on the page are marked as inferred from the affected range, so confirm them against the Broadcom advisory before planning change windows. For Telco Cloud Platform in particular, Broadcom points to KB449886 rather than an ESXi build.
What to do
- Update ESX to the fixed build for your product line from the table above. There is no workaround, and federal agencies are due by November 11, 2026; everyone else can use the same date as a target.
- Apply the rest of VMSA-2026-0006 in the same window, including the two vCenter Critical fixes, rather than patching only the lowest-scored item.
- Send ESXi and vCenter syslog to a collector off the host, so a gap in local logs can be compared against an independent copy. CrowdStrike's earlier WARP PANDA research recommends retaining and monitoring both.
- Review who holds administrator rights on ESX hosts and vCenter, and rotate credentials where you cannot account for them. The flaw is only useful to someone who already has admin access.
- Where you can, look back to early 2026 for unexplained gaps in host logs. Missing entries during that period are worth treating as a question, not as proof that nothing happened.
- Keep management interfaces off the internet, since WARP PANDA's reported route starts at exposed edge devices.
Takeaway
A 2.7 can be the quiet part of a serious intrusion. CVE-2026-41709 does nothing on its own, but a China-nexus group used it as a zero-day, months before the July patch, and it still ranks near the bottom of any score-sorted list. Exploitation status, not severity alone, is what should move it up.
To see which of your VMware products and builds fall under this CVE, along with its KEV dates and EPSS, look up CVE-2026-41709 on VulnTracker.