ESXi Logging Zero-Day CVE-2026-41709 Added to CISA KEV

CISA added CVE-2026-41709, an ESXi logging zero-day in VMware ESX, to its Known Exploited Vulnerabilities catalog on October 28, 2026, with a federal remediation deadline of November 11. Broadcom rates the flaw Low (CVSS 2.7) because it needs administrator access, but CrowdStrike reports the China-nexus group Warp Panda used it to cut audit trail visibility during intrusions at US organizations. Patch ESX to the fixed builds in VMSA-2026-0006, and treat ESXi logs from before the patch as possibly incomplete.

What happened

Broadcom disclosed CVE-2026-41709 on July 29, 2026, in security advisory VMSA-2026-0006. That bulletin also fixed the two critical vCenter flaws covered here in September, CVE-2026-59309 and CVE-2026-59310 (vCenter CVE-2026-59310 and the Babuk ESXi attacks). The advisory describes the ESX issue in one sentence: a malicious administrator can perform certain operations without them being logged. Broadcom credits Ian Barton of CrowdStrike with the report and lists no workaround.

Three months later, on October 28, CISA added the bug to the KEV catalog based on evidence of active exploitation, alongside Linux kernel flaw CVE-2026-46300. The KEV entry gives federal civilian agencies until November 11 to apply mitigations. The entry lists ransomware use as unknown, and CISA did not publish details of the activity it observed.

SecurityWeek, reporting on October 29, tied the exploitation to CrowdStrike's research. According to that report, Warp Panda used CVE-2026-41709 as a zero-day in several intrusions, as late as early 2026, to significantly reduce audit trail visibility. That puts the abuse months before Broadcom's fix shipped. The victims named are US organizations, including law firms.

Who is affected

The CVE record and Broadcom's response matrix list these affected lines and fixed versions for CVE-2026-41709:

VMware Cloud Foundation and vSphere Foundation, ESX 9.1.x: fixed in ESXi-9.1.0.0-25370933
VMware Cloud Foundation and vSphere Foundation, ESX 9.0.x: fixed in ESXi-9.0.2.0100-25595025
VMware ESX 8.0: fixed in ESXi80U3j-25429389
VMware Cloud Foundation 5.x: fixed in 5.2.4 (async patching guide KB88287)
VMware Telco Cloud Platform 5.0.x and 5.1.x: see Broadcom KB449886

The CVE-2026-41709 matrix lists no fix for ESX 7.0 or the 8.0 U2 line. If you run either, confirm your status with Broadcom support before you assume you are covered.

The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. High privileges are required and the only impact is a small integrity loss. That is why the base score is 2.7. It is also why a CVSS-sorted patch queue would put this fix near the bottom.

Technical analysis of the ESXi logging zero-day

This is a CWE-778 weakness: the product fails to record security-relevant events. It gives an attacker no access on its own. It matters after a compromise, when an intruder already holds administrator rights on a host and wants their actions missing from the record investigators will later read. We explain the class in more depth in what an insufficient logging vulnerability is.

Broadcom has not said which operations escape the log, and the SecurityWeek report does not name them either. Defenders therefore cannot write a precise detection for the gap itself. What you can do is assume that admin activity on an unpatched host may be missing from local and forwarded ESXi logs, and look for evidence in other places.

Warp Panda's history explains why the flaw was worth burning. CrowdStrike's December 2025 profile describes the group gaining initial access through internet-facing edge devices, then pivoting into vCenter with valid credentials or vCenter vulnerabilities. Once inside, it deployed the BRICKSTORM backdoor and two ESXi implants, Junction and GuestConduit. Junction listens on port 8090, the same port the legitimate vvold service uses. CrowdStrike also documented lateral movement over SSH with the privileged vpxuser account, cloned domain controller VMs, unregistered VMs that were shut down after use, and log clearing. A bug that keeps admin operations out of the log fits that pattern of quiet, long-term access.

The same advisory carries a more severe ESX bug. CVE-2026-47876 is an out-of-bounds write in the VMXNET3 virtual network adapter (CVSS 9.3) that lets a local administrator on a guest VM execute code on the host. Its fixed builds are newer than the logging fix on some branches: ESXi80U3k-25595708 on 8.0 and ESXi-9.1.0.0200-25557999 on 9.1. Broadcom's patches are cumulative, so moving to the latest build for your branch closes both.

What to do now

Inventory every ESX host and compare its build number with the response matrix above. On 8.0, go to U3k or later rather than stopping at U3j, so the VMXNET3 flaw is fixed as well.
Patch first the hosts that are managed by an internet-reachable vCenter or that sit behind edge devices with a recent compromise history. Those match Warp Panda's entry path.
Treat ESXi logs from unpatched periods as possibly incomplete. Cross-check them against evidence the host cannot suppress: vCenter events, network flow records for ESXi management interfaces, firewall logs and authentication records from your identity provider.
Forward ESXi syslog to a remote collector if you do not already. Logs held only on the host can be cleared by whoever controls it. Our guide on how to forward ESXi syslog to a remote server walks through the esxcli and Host Profiles methods from Broadcom's documentation.
Apply CrowdStrike's hardening guidance for this actor. It recommends monitoring SSH logins as root and vpxuser, considering disabling SSH on ESXi hosts, enabling the execInstalledOnly enforcement setting, watching for unsanctioned VMs and nonstandard ports such as 8090, and restricting outbound internet access from ESXi and vCenter.
If you find signs of compromise from before the patch, collect evidence before you rebuild. Patching closes the gap going forward. It does not restore events that were never written.

A low score did not stop a state-linked group from using this bug for months. The planning question is where your hypervisor evidence lives when the host itself cannot be trusted, which we cover in why hypervisor log retention must live off the host. For a related pattern on network gear, see how to detect firewall logging gaps.

What to watch next

Whether Broadcom updates VMSA-2026-0006 to say which operations went unlogged. That would let defenders hunt for the gap directly.
A full CrowdStrike write-up with indicators for the 2026 intrusions. The public reporting so far does not include them.
Whether CISA updates the KEV entry's ransomware field, which is currently "Unknown".
Guidance for ESX 7.0 and 8.0 U2 customers, whose branches are absent from the CVE-2026-41709 fix matrix.