On 28 October 2026 CISA added CVE-2026-41709, a flaw in Broadcom's VMware ESX hypervisor, to its Known Exploited Vulnerabilities catalog. US federal civilian agencies must fix it by 11 November 2026, according to Help Net Security.
What the flaw does: Broadcom describes it as an insufficient logging issue: a malicious administrator could perform some operations without them being logged. It does not give access on its own — the attacker already needs admin rights — which is why Broadcom rates it only Low (CVSS 2.7). It was fixed in advisory VMSA-2026-0006, first published on 29 July 2026; Broadcom credits Ian Barton of CrowdStrike and lists no workaround.
Who used it: In a report published on 28 October, CrowdStrike says the China-nexus group Warp Panda exploited this ESXi command logging bypass as a zero-day in several cases, "as late as early 2026", in intrusions at US entities that included legal-sector targets, and deployed several forms of malware in victims' vCenter environments. Help Net Security reports that the group usually gets in through internet-facing edge devices before moving to vCenter, and names its malware as BRICKSTORM and SharpStorm. No indicators of compromise for this CVE have been published.
Why it matters: a low score does not mean low risk here. A bug that lets intruders act on a hypervisor without leaving an audit trail makes later investigation much harder. The same Broadcom advisory also fixes critical flaws, including two vCenter bugs rated 9.8 (CVE-2026-59309, CVE-2026-59310) and an ESX VMXNET3 flaw rated 9.3 (CVE-2026-47876).
