Our takeCISA added the Broadcom VMware ESX insufficient logging flaw (CVE-2026-41709) to KEV after Warp Panda used it in the wild to cover their tracks. If you run ESX and haven't applied Broadcom's mitigations yet, do it now.Security Resilience desk
Sources (3)
- cisa_kev · cisa_kev
- hackernews · hackernews
- securityweek · securityweek
What this means for you — Security leader:CISA added CVE-2026-41709 to KEV after confirming China-linked actors (Warp Panda) exploited it in the wild to suppress logging on VMware ESXi. If you run ESXi, apply Broadcom's mitigations immediately and review audit configuration per BOD 22-01 and CISA forensics triage guidance.
What this means for you — Lean IT orgs:If you run VMware ESXi, check with your IT provider today and make sure the latest Broadcom updates are applied. This flaw lets someone with admin rights act without leaving logs, and attackers have already used it.
What this means for you — MSP:Review all client ESXi hosts for the Broadcom patch or mitigations for CVE-2026-41709; China-linked actors have used it in the wild to reduce logging visibility. Prioritize per CISA BOD 22-01 and document remediation for audit trails.
What this means for you — Researcher:CISA KEV addition for CVE-2026-41709 confirms in-the-wild exploitation by China-linked Warp Panda to suppress audit logging on ESXi after gaining admin access. Low CVSS but high operational value for stealth.