What happened
On July 29, 2026, Broadcom published security advisory VMSA-2026-0006, fixing several flaws in VMware virtualization products. One of them is CVE-2026-41709 in the VMware ESX hypervisor, also known as ESXi. According to the vendor, a malicious administrator can perform certain operations without them being logged.
Over the summer the bug looked minor, and the vendor gave it a low severity score. That changed on October 28, 2026, when the US agency CISA added it to its catalog of exploited vulnerabilities. According to The Hacker News, this followed a finding by CrowdStrike that a China-linked group called Warp Panda had used the flaw in attacks on the US legal sector.
CrowdStrike says the group exploited the flaw as a zero-day, meaning before a fix existed, as early as the beginning of 2026. The goal was to reduce what showed up in audit trails. The European vulnerability database EUVD, run by ENISA, tracks it as EUVD-2026-51107 and also marks it as exploited.
Why it is dangerous
This is a type of flaw known as insufficient logging (CWE-778). Picture an office with a CCTV system. This bug does not open any doors, but someone who already has the keys can switch off the camera for some of their actions. If a burglar gets hold of the keys, they can work without being recorded.
The attacker needs administrator access to ESX, and the attack then runs over the network. On its own, the flaw does not take over the server or steal data. Its value to an attacker is that some actions after a break-in never get logged. According to CrowdStrike, Warp Panda gets in through internet-facing edge devices and uses custom malware. The Hacker News adds that the group then moves into VMware vCenter environments to keep quiet, long-term access.
The CVSS score rates a flaw’s technical severity on a scale from 0 to 10. VMware scored this one 2.7 under CVSS 3.1, which is low. That is because the attack requires high privileges and has limited impact by itself. The score says nothing about whether the flaw is being exploited in the real world.
The CISA KEV (Known Exploited Vulnerabilities) catalog only lists flaws for which CISA has evidence of actual exploitation. US federal agencies must fix them by a set deadline, in this case November 11, 2026. CISA currently lists use by ransomware groups as unknown.
EPSS estimates the probability of exploitation in the next 30 days. As of October 28, 2026 it stood at about 0.3%, higher than roughly 22% of scored vulnerabilities. Since exploitation is already confirmed, treat EPSS as secondary information here.
Who is affected
This affects organizations running their own virtualization on VMware vSphere: the ESX (ESXi) hypervisor on physical servers, usually managed through vCenter. Think company server rooms and data centers hosting virtual servers for accounting, file shares, email or databases. It also covers hosting and private cloud providers that build on VMware.
- VMware ESX (vSphere ESXi) 9.1, 9.0 and 8.0 branches before the fixed builds
- VMware Cloud Foundation and VMware vSphere Foundation (ESX component), for Cloud Foundation 5.x before version 5.2.4
- VMware Telco Cloud Platform (ESX component)
The same advisory patches the desktop products VMware Workstation and Fusion for other bugs, but neither CISA nor The Hacker News lists them for CVE-2026-41709. The list of fixed versions in The Hacker News does not include the older ESXi 7.0 branch. If you still run it, check with Broadcom support. If you do not use VMware at all, this flaw does not affect you.
How to check if you are affected
The easiest way is to open the vSphere Client, select a host and check the Summary tab for the version and build number. Without vCenter, log in to the web-based ESXi Host Client, where the version is shown on the host’s main page. Compare the build with the fixed versions in the next section.
If SSH or the ESXi Shell is already enabled, these commands only print the version and change nothing:
vmware -vl
esxcli system version getFor an overview of all hosts at once, use PowerCLI after connecting to vCenter with Connect-VIServer:
Get-VMHost | Select-Object Name, Version, BuildDo not leave SSH enabled just for this check. Open management access to the hypervisor is a risk in itself.
How to fix it
A fix is available. According to The Hacker News, summarizing Broadcom’s advisory, CVE-2026-41709 is fixed in these versions:
- VMware Cloud Foundation and vSphere Foundation 9.1: ESXi-9.1.0.0-25370933
- VMware Cloud Foundation and vSphere Foundation 9.0: ESXi-9.0.2.0100-25595025
- VMware ESX 8.0: ESXi80U3j-25429389
- VMware Cloud Foundation 5.x: 5.2.4
- VMware Telco Cloud Platform: ESXi80U3j-25429389
The same advisory also fixes a critical ESX flaw, CVE-2026-47876 (CVSSv3 score 9.3 per Broadcom), in builds ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708 and ESXi80U2f-25626445. Broadcom notes for vCenter that patches are cumulative. If you go straight to the newest build, check the advisory to confirm it also covers CVE-2026-41709. This matters most for ESXi80U2f-25626445, which The Hacker News does not list among the fixes for this flaw. For vCenter, the advisory fixes two critical flaws (CVSSv3 score 9.8 per Broadcom) in versions 9.1.0.0300, 9.0.2.0100, 8.0 U3k and 8.0 U2f. Broadcom lists no workaround.
- Inventory all ESX hosts and vCenter instances and their builds.
- Update vCenter first, then the ESX hosts. This is the usual order for vSphere, and vCenter has critical flaws in the same advisory.
- Before you start, back up the configuration and verify your virtual machine backups.
- Update hosts one at a time: move VMs off with vMotion, put the host into maintenance mode, apply the patch through vSphere Lifecycle Manager, reboot and confirm the new build.
- Restrict administrator access: only necessary accounts, strong passwords, and manage ESX and vCenter only from a separate network, never from the internet.
CISA gave US federal agencies a deadline of November 11, 2026. It is not binding for you, but it is a useful benchmark.
What if you may already be compromised
The whole point of this flaw is that some attacker actions never reach the logs. Clean ESX logs are therefore no proof that nothing happened. Neither CISA nor The Hacker News has published specific indicators for this flaw, such as file hashes or IP addresses.
- Internet-facing devices such as VPN gateways, firewalls and remote access tools: according to CrowdStrike, this is how Warp Panda gets in.
- vCenter: unknown accounts, unexpected permission changes and suspicious files. The Hacker News mentions the BRICKSTORM and SharpStorm malware in this context.
- ESX hosts: review local accounts (
esxcli system account list) and installed packages (esxcli software vib list) and look for anything you do not recognize. - Microsoft 365: new MFA devices nobody on your team registered, and unusual sign-ins. CrowdStrike says the group registers rogue MFA devices. According to The Hacker News, this lets it keep access even after a password change.
- Compare records from your firewall, vCenter and an external syslog server. Mismatches can reveal what is missing from the ESX logs.
If you find anything suspicious, or you handle sensitive client data, bring in an incident response specialist. Cleaning up on your own can destroy evidence and simply tip off the attacker.