VMware ESX logging flaw now exploited: Update 2 patches miss it

CISA added CVE-2026-41709, a flaw in VMware ESX, to its Known Exploited Vulnerabilities catalog on October 28 and gave federal agencies until November 11 to fix it. Broadcom's advisory describes it this way: an administrator with bad intent can carry out "certain operations without them being logged." Broadcom rates it low, at 2.7 out of 10 on CVSS; the attacker must already be an administrator on the host. It has not said which operations go unrecorded. Ian Barton of CrowdStrike reported the bug.

The low score is why it matters now. According to Help Net Security, CrowdStrike says a China-nexus espionage group it calls Warp Panda exploited the bug before any fix existed, during a break-in early this year, and that it cut how much of the attack showed up in audit trails. CrowdStrike's legal-sector threat report, out on October 28, says the group used an ESXi zero-day to keep its access hidden. Help Net Security reports that the group typically gets in through internet-facing edge devices, then moves into vCenter, installs BRICKSTORM and SharpStorm malware, and reaches Microsoft 365 with stolen session tokens, sometimes adding its own MFA devices to accounts.

Why a summer patch may not cover it

Broadcom fixed the flaw on July 29, in VMSA-2026-0006, 91 days before the CISA listing. That advisory was rated critical because of other bugs in it: an authentication bypass and a directory traversal in vCenter, and a VM escape through the VMXNET3 network adapter in ESX. Teams that rushed to close those may not have taken everything.

Broadcom's own question-and-answer page for the advisory spells out two gaps:

• vSphere 8.0 Update 2. Broadcom added 8.0 U2f patches on August 3, but its FAQ says those Update 2 patches fix the critical CVEs and nothing else. The 8.0 fix for CVE-2026-41709 in Broadcom's table is ESXi80U3j-25429389, and the FAQ points to 8.0 Update 3k or newer for the non-critical fixes. A host patched to U2f still has this flaw.
• vSphere 7. General support ended on October 2, 2025. The August 19 update added 7.0 guidance for the critical issues only, and the CVE-2026-41709 table lists no 7.0 build. Customers with extended support have to ask Broadcom.

The same page still says Broadcom has no sign of the advisory's flaws being used in attacks. That text reflects the August 19 revision, written before the CISA listing.

Fixed builds for CVE-2026-41709

Broadcom lists no workaround. ESX updates need a host restart, so plan vMotion moves; some updates qualify for Live Patch. Versions 6.5 and 6.7 should be presumed affected, and Broadcom's answer for them is to move to VCF 9.1. Broadcom's policy on critical patches for perpetual-license customers is in KB 314603.

What the logging gap means for an investigation

A host with this flaw cannot be relied on to have recorded everything an administrator did. If an attacker had admin access to an ESX host before it was patched, the absence of suspicious entries in its logs does not show that nothing happened. Patching closes the gap from now on. It does not fill in the missing record.

Related: Cisco's ASA and FTD VPN zero-day and the BeyondTrust Remote Support zero-day.