CISA lists a low-severity VMware ESX flaw that hides administrator actions as exploited
October 28, 2026 (Fixed July 29, listed as exploited October 28, 2026)
CVE-2026-41709, rated low (CVSS 2.7), lets a malicious administrator perform certain actions on VMware ESX hosts without them being recorded in audit logs. Broadcom fixed it in advisory VMSA-2026-0006 on July 29 and credits CrowdStrike for reporting it. CISA added it to its exploited list on October 28 with a federal deadline of November 11. The Hacker News, as relayed by CISO Platform, reports that CrowdStrike links early-2026 exploitation to Warp Panda, a China-nexus group also tracked as Armory Castle, against US legal-sector organizations. No government has made that attribution. Fixed builds are ESXi 8.0 U3j (ESXi80U3j-25429389), ESXi 9.0.2.0100-25595025, ESXi 9.1.0.0-25370933 and VMware Cloud Foundation 5.2.4.
Why it matters
A low score hides the point: the flaw exists to erase evidence. It matters after an intruder already has administrator access, because gaps in logging make it hard to say what they did on the virtualization layer.
What defenders can take from it
- Apply the fixed builds, starting with hosts whose management access is shared or exposed.
- Send hypervisor and vCenter logs to a system that administrators cannot alter, so a gap on the host stands out.
- Review vCenter administrator accounts, session tokens and MFA registrations for unexpected additions, and keep management on a separate network.