News

A CVSS 2.7 VMware ESX Logging Flaw Was a China-Nexus Zero-Day, and Is Now on CISA KEV

Published October 29, 2026 · 5 min read · By the Attack Surface Scan team

In brief

CVE-2026-41709 lets an administrator on VMware ESX perform certain operations without them being logged. Broadcom rated it CVSS 2.7 and fixed it in July in VMSA-2026-0006, an advisory whose critical bugs drew most of the attention. On October 28, CrowdStrike reported that the China-nexus group Warp Panda had exploited it as a zero-day, as late as early 2026, to cut its audit trail during intrusions at US organizations, including law firms. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal deadline of November 11. If you deferred the fix because of the score, apply it now.

What happened

Broadcom's advisory VMSA-2026-0006, issued July 29, 2026, fixed five VMware CVEs, several of them critical. One was CVE-2026-41709: "VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged." Broadcom did not say which operations. It scored the flaw CVSS 3.1 2.7 (high privileges required, low integrity impact), listed no workaround, and credited Ian Barton of CrowdStrike with reporting it.

The reason CrowdStrike found it became clear on October 28. CrowdStrike's 2026 Legal Threat Landscape Report says WARP PANDA, a China-nexus adversary, deployed malware in victims' VMware vCenter environments in multiple intrusions at US-based entities, including the legal sector, and that "in several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day." SecurityWeek reports it was used "to significantly reduce audit trail visibility." The Hacker News reports the group's initial access came through internet-facing edge devices before a pivot to vCenter, and lists Armory Castle (formerly UNC5221) among its aliases, the same group behind the BeyondTrust Remote Support zero-day. CISA added the CVE to the KEV catalog the same day, with a remediation deadline of November 11.

Why it matters if you run public infrastructure

A 2.7 is the kind of score that gets a patch pushed to next quarter. But the score measures what the bug does on its own, and this one only matters to an attacker who already has admin on the hypervisor, which is exactly when it matters most. An attacker with ESXi admin can reach every virtual machine on the host, and a logging bypass makes that access harder to see and to reconstruct afterward. The way in was not ESXi itself: it was an edge device on the internet, then vCenter. That is the pattern behind many of this month's KEV listings.

What to check this week

Patch ESX to the fixed build for your version: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 or ESXi80U3j-25429389, or Cloud Foundation 5.2.4. Telco Cloud Platform 5.0 and 5.1 use the 8.0 U3j build (Broadcom KB 449886). ESX 7.0 has no listed fix for this CVE, so ask Broadcom if you are on extended support. While you are in VMSA-2026-0006, apply the fixes for its critical CVEs too.
Assume the hypervisor logs are incomplete. If ESXi or vCenter could have been reached by an attacker this year, review what else recorded admin activity: vCenter events, your identity provider and the network logs around the management interfaces.
Check the edge devices first. The intrusions began on internet-facing appliances. Make sure firewall, VPN and remote access appliances are patched for this month's KEV entries.
Keep management interfaces off the internet. ESXi and vCenter should be reachable only from a management network or VPN.

How Attack Surface Scan covers this

Attack Surface Scan does not identify VMware ESX or vCenter versions and will not raise a CVE finding for this flaw, which in any case needs admin access first. What it does cover is the part of this campaign that happens on the internet. It inventories the hosts under your verified domains, including ones found in certificate transparency logs, with their open ports, web services and TLS certificates, so a vCenter or ESXi interface published by mistake shows up. It also flags the edge products it can identify (FortiGate, NetScaler, Ivanti, GlobalProtect) against this month's KEV listings. We do not send exploit traffic. See Vulnerability matching for which products we match CVEs against.

Frequently asked questions

Why is a CVSS 2.7 bug on the KEV catalog?

KEV lists vulnerabilities with evidence of exploitation, whatever their score. This one was used in real intrusions to hide activity, which is why CISA set a deadline for it.

Can this be exploited from the internet?

Only by someone who already has administrator access to the ESX host. In the reported intrusions, that access came from compromised edge devices and vCenter.

Sources

See which management interfaces your domains expose

Attack Surface Scan inventories the hosts, open ports and certificates under your domains and flags exploited edge products, the usual way into vCenter. 7-day trial, no card required.

Start your 7-day trial