Skip to content
eastbaycyber

Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

CVE-2026-41709 Exploited to Reduce VMware ESX Audit Visibility

Breaking news 7 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

CVE explainers: CVE-2026-41709

TL;DR - Since the last update, Broadcom’s published remediation details include fixed versions for additional affected VMware products, including VMware Cloud Foundation and VMware vSphere Foundation. - CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on October 28, 2026, based on evidence of active exploitation. - CISA describes CVE-2026-41709 as a Broadcom VMware ESX insufficient logging vulnerability that could allow an attacker with admin access to perform certain operations without being logged. - The Hacker News reports that CrowdStrike linked exploitation in early 2026 to Warp Panda activity targeting the U.S. legal sector and reducing audit trail visibility. - CISA lists 2026-11-11 as the due date for the VMware ESX entry.

What happened#

CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on October 28, 2026, based on evidence of active exploitation. CISA identifies it as a “Broadcom VMWare ESX Insufficient Logging Vulnerability.” Its catalog entry says the vulnerability could allow a malicious actor with admin access to perform certain operations without being logged. CISA lists the vulnerability as not known to be used in ransomware campaigns. CISA’s alert and CISA’s catalog provide the government’s listing.

The catalog gives CVE-2026-41709 a date added of 2026-10-28, a due date of 2026-11-11, and says forensic triage is not required per BOD 26-04. Its action is to apply mitigations in accordance with vendor instructions and applicable BOD 26-04 guidance. The catalog also says organizations should evaluate each asset’s internet exposure and follow guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Broadcom’s VMSA-2026-0006.1 notification says updates address multiple vulnerabilities, including CVE-2026-41709. The notification lists VMware Cloud Foundation, VMware Fusion, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform, VMware vCenter Server, VMware vSphere ESXi, VMware vSphere Foundation, and VMware Workstation among the impacted products. It shows a status of OPEN, a severity of CRITICAL, a CVSS base score range of 2.7-9.8, and no workaround. Broadcom’s notification was last updated 19 August 2026.

The Hacker News reports that CrowdStrike identified exploitation of CVE-2026-41709 as a zero-day in early 2026. It reports that the activity was associated with Warp Panda and targeted the U.S. legal sector, with the aim of reducing audit trail visibility. The report attributes those details to CrowdStrike’s 2026 Legal Threat Landscape Report, rather than to CISA’s catalog.

Are you affected#

Organizations may be affected if they operate VMware products covered by Broadcom’s advisory. Broadcom lists VMware Cloud Foundation, VMware Fusion, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform, VMware vCenter Server, VMware vSphere ESXi, VMware vSphere Foundation, and VMware Workstation as impacted products.

Broadcom’s published response matrix lists the following fixed versions for CVE-2026-41709:

  • VMware Cloud Foundation, ESX, 9.1.x.x: ESXi-9.1.0.0-25370933.
  • VMware Cloud Foundation, ESX, 9.0.x.x: ESXi-9.0.2.0100-25595025.
  • VMware vSphere Foundation, ESX, 9.1.x.x: ESXi-9.1.0.0-25370933.
  • VMware vSphere Foundation, ESX, 9.0.x.x: ESXi-9.0.2.0100-25595025.
  • VMware ESX, version 8.0: ESXi80U3j-25429389.
  • VMware Cloud Foundation, ESX, 5.x: VMware Cloud Foundation 5.2.4.
  • VMware Telco Cloud Platform, ESX, 5.0.x and 5.1.x: ESXi80U3j-25429389.

Broadcom’s notification states that updates are available to remediate the vulnerabilities in affected products. The response matrix also lists VMware Workstation and VMware Fusion in the advisory, but the material provided here does not show a CVE-2026-41709 fixed version for those products. Teams should compare their deployed products and versions with the complete Broadcom notification.

The VMware Telco Cloud response article lists CVE-2026-41709 for VMware Telco Cloud Platform versions 5.0.x and 5.1.x, with ESXi80U3j-25429389 as the fixed version. It lists TCI as None for this CVE. Broadcom’s Telco Cloud article contains those product-specific details.

What is confirmed and what is reported#

Claim Source Status
CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on October 28, 2026, based on evidence of active exploitation. CISA alert Confirmed
CVE-2026-41709 is a Broadcom VMware ESX insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. CISA catalog Confirmed
CISA lists 2026-11-11 as the due date and says forensic triage is not required per BOD 26-04. CISA catalog Confirmed
Broadcom lists VMware Cloud Foundation, VMware Fusion, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform, VMware vCenter Server, VMware vSphere ESXi, VMware vSphere Foundation, and VMware Workstation among the impacted products in VMSA-2026-0006.1. Broadcom notification Reported
Broadcom lists ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, and VMware Cloud Foundation 5.2.4 as fixed versions for listed product and version combinations. Broadcom notification Reported
The VMware Telco Cloud article lists ESXi80U3j-25429389 as the fixed version for VMware Telco Cloud Platform versions 5.0.x and 5.1.x, and does not list the CVE for VMware Telco Cloud Infrastructure. Broadcom Telco Cloud article Reported
CrowdStrike linked exploitation of CVE-2026-41709 to Warp Panda, a China-nexus threat actor, in activity targeting the U.S. legal sector. The Hacker News Reported
The activity was intended to reduce audit trail visibility and included bypassing audit logging, harvesting cloud session tokens, and registering rogue MFA devices. The Hacker News Reported

What defenders should do now#

  1. Identify VMware ESX and related VMware products in use, including VMware Cloud Foundation, VMware vSphere Foundation, VMware vSphere ESXi, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure, VMware vCenter Server, VMware Workstation, and VMware Fusion.

  2. Compare deployed versions with Broadcom’s VMSA-2026-0006.1 notification and the applicable product-specific guidance. For CVE-2026-41709, review the fixed versions listed for the relevant VMware product and version.

  3. Prioritize CVE-2026-41709 in vulnerability-management workflows. CISA says organizations should use the KEV catalog as an input to vulnerability-management prioritization and encourages all organizations to prioritize remediation of KEV vulnerabilities.

  4. Apply mitigations in accordance with Broadcom’s instructions. CISA’s catalog action directs organizations to follow vendor guidance and applicable BOD 26-04 guidance.

  5. Evaluate the internet exposure of each affected asset. CISA says stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to applicable patching guidance.

  6. Review relevant VMware security telemetry in light of the reported activity. The Hacker News reports that Warp Panda activity involved efforts to bypass audit logging, harvest cloud session tokens, and register rogue MFA devices. These details are not described in CISA’s catalog entry.

  7. For Federal Civilian Executive Branch agencies, follow applicable BOD 26-04 requirements and the 2026-11-11 due date listed by CISA. CISA states that BOD 26-04 applies only to FCEB agencies, while encouraging all organizations to use the KEV catalog for prioritization.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

Last verified: 2026-11-01

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.