CVE-2026-41709

What is VMware ESX?

VMware ESX, still widely called ESXi, is Broadcom's bare-metal hypervisor. It runs directly on server hardware and hosts the virtual machines beneath a large share of enterprise and government datacentres, managed centrally through vCenter and packaged inside VMware Cloud Foundation, vSphere Foundation, and Telco Cloud Platform.

The hypervisor sits below every guest operating system, so an attacker on the ESX host is below the EDR agents, the guest audit logs, and the domain controllers running inside the virtual machines. That position is exactly why ESXi has become a favourite target for both ransomware crews and state-aligned intrusion sets, and it is why ESXi's own command and operation logs, shipped to syslog or vCenter, are often the only telemetry a defender has for that layer.

Overview

CVE-2026-41709 is an insufficient logging flaw in VMware ESX. An actor who already holds administrative access to the host can carry out certain operations without those operations being recorded. Broadcom's own description is blunt and brief: the issue "permits an administrator to perform operations on ESX without those operations being recorded."

On paper this is the least interesting entry in its advisory. Broadcom rated it Low at CVSS 2.7, the lowest score in VMSA-2026-0006, a bundle whose headline items were two CVSS 9.8 vCenter flaws and a CVSS 9.3 VMXNET3 VM escape. The vector, AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, reflects what the score is measuring: high privileges required, no confidentiality or availability impact, and only a low integrity impact, that impact being the integrity of the audit trail itself.

The CVSS model does not price evidence destruction, which is why this one went from an afterthought to a KEV entry. CrowdStrike's 2026 Legal Threat Landscape Report states that the China-nexus adversary it tracks as WARP PANDA "deployed several forms of malware in victims' VMware vCenter environments" and that "in several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day." That places real exploitation months before the July 2026 patch. CISA added the flaw to KEV on 2026-10-28 with a 2026-11-11 deadline.

Affected Versions

ESX 5.x is also listed as affected in the CSAF record, which matters for anyone still running long-unsupported hosts. Patches are cumulative, so a host already moved to a later build in the same line is covered. Broadcom states plainly that any ESX version released before the fixed build should be assumed vulnerable, and the newer ESXi80U3k-25595708 build published for the VMXNET3 escape also carries this fix.

Technical Details

CWE-778, insufficient logging, means the software performs a security-relevant action and produces no record of it. There is no memory corruption here and nothing to overflow. The defect is that a specific class of ESX operations bypasses the code path that writes to the host's command and operation logs, so the operations execute normally and leave the log looking as though nothing happened.

Neither Broadcom nor CrowdStrike has disclosed which operations are affected or how the bypass is triggered, and no proof of concept is public. That gap is deliberate and it limits what defenders can hunt for: there is no published command string, log signature, or indicator list to search on. CrowdStrike's report names no indicators for this activity.

What is clear from the CVSS vector is the attack shape. Access is over the network and complexity is low, but privileges required are High, meaning the actor must already hold ESX administrative credentials. The flaw is therefore not an entry point. It is a post-compromise capability, used after credential theft, after a vCenter compromise, or after a VM escape, to make the subsequent actions invisible. In WARP PANDA's case the malware was already resident in vCenter environments before this flaw came into play.

Discovery

Broadcom published the issue on 2026-07-29 in VMSA-2026-0006, alongside CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, and CVE-2026-41703. Broadcom's advisory thanks a researcher for each CVE, but the acknowledgement for CVE-2026-41709 is not reproduced in the NVD, CVE.org, or NCSC-NL records, and the press coverage of the advisory named no reporters. Some secondary write-ups credit Ian Barton of CrowdStrike; that is consistent with CrowdStrike having found the technique in incident response, but it is not confirmed by a primary source and should be treated as unverified.

What is documented is the sequence. CrowdStrike observed the exploitation as a zero-day during intrusions at United States entities, including targets in the legal sector, within its reporting window of 2025-09-01 to 2026-08-31, with activity continuing into early 2026. The patch followed in July, and the public attribution followed in October.

Exploitation Context

Confirmed exploitation rests on CrowdStrike's report. WARP PANDA, a China-nexus adversary, used the flaw as a zero-day in multiple intrusions against United States organisations, with the legal sector named explicitly. CrowdStrike's framing is that the group first established itself in victims' vCenter environments with several malware families, then used CVE-2026-41709 to suppress logging of its ESXi activity.

There are no public exposure counts for this flaw, and counting internet-facing ESX hosts would not measure it anyway, since the attacker needs administrative access before it is useful. There is no evidence of ransomware use and no public proof of concept. Broadcom's advisory, last revised as VMSA-2026-0006.2 on 2026-08-19, still carries its standard line that it has no information suggesting exploitation has occurred in the wild, and has not been withdrawn or updated to match CISA's determination. Read that as a stale vendor statement rather than a contradiction.

Note also that CVE-2026-41709 is a natural second stage for the other ESX flaw in the same advisory: CVE-2026-47876, the CVSS 9.3 VMXNET3 out-of-bounds write that lets a VM administrator execute code on the host. Escape to the host, then silence the host's record of what you do next. No public report confirms that specific pairing, but both are fixed by the same update, so there is no reason to treat them separately.

Remediation

1. Update ESX to ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, or ESXi80U3j-25429389, matching your line. There are no workarounds; Broadcom classifies this advisory as an emergency change.
2. Apply the whole of VMSA-2026-0006 in one pass rather than this CVE alone. The two CVSS 9.8 vCenter flaws, CVE-2026-59309 and CVE-2026-59310, are already KEV entries and are far more likely to be how an attacker reaches administrative access in the first place.
3. Update VMware Cloud Foundation 5.x to 5.2.4, and apply the async ESX patch for Cloud Foundation, vSphere Foundation, and Telco Cloud Platform 5.0.x and 5.1.x deployments.
4. Treat the gap in logging as a detection gap for the whole period a host was unpatched. Compare ESXi host logs against vCenter task and event history, syslog receiver records, and network flow data for the same window; the operations this flaw hides will often still show up as side effects elsewhere.
5. Forward ESXi logs off the host to a syslog collector the hypervisor administrator cannot reach, if you are not doing so already. That is the control that survives a logging bypass on the host itself.
6. Review management plane activity for unexpected vCenter authentication, unusual administrative sessions, new or modified ESXi local accounts, SSH or shell enablement on hosts, and any unsigned VIB installation.
7. If your environment matches the targeting profile, a United States organisation with a vCenter estate, and especially in the legal sector, treat unpatched hosts as candidates for compromise assessment rather than merely for patching, and rotate ESX and vCenter administrative credentials.
8. Federal civilian agencies must remediate by 2026-11-11 under BOD 22-01, and should follow CISA's forensic triage requirements before remediating.