Low-Severity ESXi Logging Flaw Hits CISA KEV

Patch ESXi, and stop ranking bugs by CVSS alone. CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday. It is a low-severity insufficient logging flaw in Broadcom VMware ESX, scored CVSS 2.7, and a China-nexus group used it as a zero-day. Federal civilian agencies have until November 11, 2026 to apply fixes, per The Hacker News.

What changed

The flaw lets an attacker who already has administrator access perform certain operations without those operations being logged. Broadcom fixed it in its July 2026 advisory, disclosed July 29 alongside three critical and one high-severity bug in vCenter, ESXi, Workstation and Fusion, according to SecurityWeek.

CrowdStrike’s 2026 Legal Threat Landscape Report says the actor Warp Panda exploited it as a zero-day in early 2026 to reduce audit trail visibility. CISA gave no details on the exploitation it observed.

Why a 2.7 matters

On its own the bug grants nothing. It needs admin access first. The point is what it does after: it blinds the logs you would use to reconstruct an intrusion.

CrowdStrike describes Warp Panda as a group that gets in through internet-facing edge devices, pivots to vCenter, and deploys custom malware such as BRICKSTORM and SharpStorm for persistence. In some intrusions it also took cloud session tokens to reach Microsoft 365 and registered a rogue MFA device to survive a password reset.

What to do

1. Update to a fixed build: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 or ESXi80U3j-25429389 or newer. VMware Cloud Foundation 5.2.4 is also listed as fixed in the reporting.
2. Treat any host that ran an unpatched build with admin exposure as one where missing logs prove nothing. Forward ESXi and vCenter logs off-host so an admin-level actor cannot quietly gap them.
3. Review MFA device registrations and session token activity on Microsoft 365 accounts tied to the same admins.
4. Keep management interfaces off the internet.

Priority call

Patch this ahead of other low-score VMware items, and in the same window as the earlier critical bugs from that July batch. CVE-2026-59309 and CVE-2026-59310 have also been exploited, with mass targeting of the latter flagged in early September.

Related coverage: Broadcom’s July VMware patch batch and the vCenter and ESXi auth bypass and VM escape fixes.