Overview
- CISA on Oct. 29, 2026 added CVE-2026-41709 to its KEV catalog and told Federal Civilian Executive Branch agencies to install Broadcom/VMware’s July fixes by November 11, 2026.
- CVE-2026-41709 is a low‑severity (CVSS 2.7) insufficient‑logging flaw that can let an administrator perform actions that are not recorded, making intrusions harder to detect.
- Broadcom issued patches for ESXi and related products in a July 29 advisory (for example ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389) and those builds are listed as the remediated versions.
- CrowdStrike reported that the China‑nexus actor Warp Panda exploited the flaw as a zero‑day in early 2026 to reduce audit trail visibility after gaining access through internet‑facing edge device zero‑days and then pivoting to vCenter to deploy malware such as BrickStorm and SharpStorm.
- Security firms warn the flaw sits inside a broader pattern of VMware targeting that includes exploited critical bugs (CVE-2026-59309 and CVE-2026-59310), mass compromises of vCenter servers, theft of cloud session tokens, rogue MFA registration, and heightened risk for organizations that hold sensitive client data.