74 openlast updated

HomeOctober 2026 patch cycleCVE-2026-41709 ESXi: exploited flaw that skips the logs

Patch nowEnterpriseHomelabfrom 2026-10

CVE-2026-41709 ESXi: exploited flaw that skips the logs

Part of October 2026 patch cycle

Vendor
VMware
Products
VMware ESXi 8.0, VMware ESX 9.0, VMware ESX 9.1, VMware Cloud Foundation, and VMware vSphere Foundation
Published
Status
Open

Call: Patch now. Broadcom rates CVE-2026-41709 Low (CVSS 2.7): an ESXi administrator can do “certain operations” without them being logged. It was fixed on July 29 in VMSA-2026-0006. On Oct 28, CISA added it to KEV, with a Nov 11 deadline for federal agencies. CrowdStrike, which reported the bug, says the China-nexus group Warp Panda used it as a zero-day to cut its audit trail in US intrusions, law firms among them, as late as early 2026. A low score doesn’t make it a low priority. It’s what an attacker uses after getting in to keep you from seeing it.

What it does: Nothing on its own. It needs admin on the host already. Warp Panda typically gets in through internet-facing edge devices and moves to vCenter, per CrowdStrike via SecurityWeek. That’s why the whole of VMSA-2026-0006 matters, not just this CVE. The same advisory fixes two critical vCenter bugs, CVE-2026-59309 (auth bypass) and CVE-2026-59310 (directory traversal to code execution), and 59310 has been in KEV since Aug 18. (SecurityWeek, HOL)

Fixed builds for CVE-2026-41709 (per Broadcom):

  • ESXi 8.0: ESXi80U3j-25429389 or later.
  • ESX 9.0.x: ESXi-9.0.2.0100-25595025.
  • ESX 9.1.x: ESXi-9.1.0.0-25370933 or later.
  • VCF 5.x: 5.2.4. Telco Cloud Platform: KB449886.

Broadcom lists no fix for ESXi 7.0 for this CVE. If you’re on the July patches or later, you already have it. If you’re still on ESXi 7.0 or an older 8.0 build, this is one more reason to move.

After patching: Anyone with root on an ESXi host controls that host’s logs, and the patch doesn’t change that. So don’t treat a clean local log as proof that nobody was there. Check that logs leave the host (esxcli system syslog config get, where an empty remote host means they don’t), and send them to a collector the ESXi admin account can’t touch. Then look at esxcli software acceptance get and esxcli software vib list for anything VMware didn’t sign, and compare esxcli system account list with the accounts you expect. (HOL)

Sources: Broadcom VMSA-2026-0006, CISA KEV alert, SecurityWeek, HOL.

Sources

More from October 2026 patch cycle