If your business runs its own VMware servers, or rents virtual servers from a provider that does, one entry on CISA's exploited list deserves a look this week. On 28 October 2026 CISA added CVE-2026-41709, a VMware ESX flaw, to its Known Exploited Vulnerabilities catalog.
Hosts like these run many virtual servers at once, so one weak management layer affects all of them. Photo: Derrick Coetzee, CC0, via Wikimedia Commons
The short answer
Broadcom describes the bug as insufficient logging: a malicious administrator could perform certain operations on an ESX host without them being logged. Broadcom scores it Low, CVSS 2.7, because it does not give anyone access by itself. It matters for a different reason. If an intruder already has admin rights, missing log entries mean you cannot reconstruct what they did.
The Hacker News, citing CrowdStrike's 2026 Legal Threat Landscape Report, reports that a China-nexus group tracked as Warp Panda used the flaw as a zero-day in early 2026 to reduce audit trail visibility, in attacks aimed at the US legal sector. That attribution comes from CrowdStrike's report, not from CISA or Broadcom.
Why a logging gap is a real problem
Audit logs are the record of who did what on a server. They are how you answer the questions that follow any incident: which account was used, what changed, and whether data left. If a flaw lets someone with administrator rights act without leaving entries, the damage is not the missing line itself. It is that your investigation starts blind, your insurer or regulator asks for evidence you cannot give, and you cannot be sure the intruder is gone.
That is also why a low score can understate the risk. The CVSS number measures what the bug does on its own, and this one gives nobody access. CISA's list asks a different question: is it being used in real attacks? Per CISA's entry the answer is yes, which is the reason to move it up your list.
How the three flaws fit together
Think of the advisory as one patch covering three layers of trouble:
- vCenter authentication bypass (CVE-2026-59309): lets someone skip the login step on the server that manages your hosts.
- vCenter directory traversal (CVE-2026-59310): can lead to code execution on that management server.
- ESX logging flaw (CVE-2026-41709): lets a malicious administrator act on a host without a log entry.
The first two are about getting in and taking control; the third is about hiding what happened afterwards. They sit in one advisory, so patch them in one maintenance window.
A safe patch order
- Inventory first. Write down every host and vCenter server, its product and its build number. A forgotten lab or test host is a common gap.
- Check your support status. Fixes for ESX 7.0 and vCenter 7.0 need an extended support contract. Decide now whether to buy it or move to a supported version.
- Back up before you change anything. Take a vCenter backup and export host configuration so you can roll back.
- Patch vCenter, then hosts. Follow the order in Broadcom's upgrade notes for your version.
- Verify the build numbers. Compare what each host reports with the fixed build in the table above, and record the date.
- Confirm logging works. After patching, do a harmless admin action and check that it appears in your log system.
Fixed builds
Broadcom fixed the issue in advisory VMSA-2026-0006, first issued on 29 July 2026:
| Product | Fixed build |
|---|---|
| ESX in VMware Cloud Foundation or vSphere Foundation 9.1 | ESXi-9.1.0.0-25370933 |
| ESX in VMware Cloud Foundation or vSphere Foundation 9.0 | ESXi-9.0.2.0100-25595025 |
| VMware ESX 8.0 | ESXi80U3j-25429389 |
| VMware Cloud Foundation 5.x | 5.2.4 |
Broadcom lists no workaround. Check the advisory for your exact product, because patches are cumulative and later builds include earlier fixes.
Patch vCenter in the same window
The same advisory fixes two Critical vCenter flaws: CVE-2026-59309, an authentication bypass, and CVE-2026-59310, a directory traversal that could allow code execution. Both score 9.8 and Broadcom lists no workarounds. A third ESX issue, CVE-2026-47876 in the VMXNET3 adapter, scores 9.3. Fixes for vCenter and ESX 7.0 are available only to customers with an extended support contract, so check your support status.
What to do
- List every ESX host and vCenter server you run, and their build numbers.
- Apply the fixed builds for ESX and vCenter from VMSA-2026-0006 in one maintenance window.
- Keep vCenter and host management interfaces off the public internet; restrict them to a VPN or admin network.
- Forward host and vCenter logs to a separate logging system that administrators cannot edit.
- Review who holds administrator rights, and remove accounts that are no longer needed.
- Use phishing-resistant multi-factor authentication, and review the registered MFA devices on admin accounts.
- Running ESX 7.0 without extended support? Plan the move, because the critical fixes need that contract.
- Using a hosting provider? Ask whether its VMware hosts are on the fixed builds.
Why smaller businesses should care
You do not need a data centre to depend on virtualisation. Many IT providers and hosts run VMware, and an unpatched management layer affects every customer on it. The lesson is the same as for the Cisco VPN flaw and the Linux kernel bug this week: keep a list of what you run, patch on a schedule, and keep logs somewhere an intruder cannot reach. Our website maintenance guide covers building that routine.
CISA set a due date of 11 November 2026 for US federal civilian agencies. Private businesses are not bound by it, but it is a reasonable target.
Common mistakes to avoid
- Treating Low as "later". Severity scores describe the bug; the exploited list describes the risk today.
- Patching hosts but not vCenter. The two Critical flaws are in vCenter, and they are the ones with no workaround.
- Keeping logs only on the host. If an administrator can edit or skip them, they are not evidence. Ship them to a separate system.
- Skipping the owner check. If a hosting provider runs your VMware, you still need written confirmation that it patched.
Key takeaways
- CVE-2026-41709 is on CISA's exploited list as of 28 October 2026, despite its Low score.
- Patch vCenter and ESX together using advisory VMSA-2026-0006; there is no workaround.
- Send logs to a system administrators cannot edit, and keep management interfaces off the public internet.
- ESX 7.0 and vCenter 7.0 fixes need an extended support contract.
Sources
- Broadcom advisory VMSA-2026-0006.2: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
- CISA Known Exploited Vulnerabilities catalog entry, added 28 October 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NVD record for CVE-2026-41709: https://nvd.nist.gov/vuln/detail/CVE-2026-41709
- The Hacker News, "China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility", 29 October 2026: https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html
