[悪用確認] CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability
Broadcom VMware ESX Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-11)
Read on CISA Known Exploited Vulnerabilities
VulnPulse explainer
VMware ESX flaw that leaves some admin actions unrecorded is added to CISA KEV after zero-day use
CISA added CVE-2026-41709 to its exploited-vulnerabilities list on 2026-10-28. With administrator rights on ESX, an attacker can carry out certain actions that never reach the logs. Broadcom fixed it in July in VMSA-2026-0006.
Who is affected
Organizations that run VMware ESX (ESXi) themselves. Broadcom's advisory lists these fixed builds: ESXi80U3j-25429389 for ESX 8.0, ESXi-9.0.2.0100-25595025 for ESX 9.0.x, ESXi-9.1.0.0-25370933 for ESX 9.1.x, 5.2.4 for VMware Cloud Foundation 5.x, and KB449886 for Telco Cloud Platform 5.0.x and 5.1.x. vCenter, Workstation and Fusion do not appear in the table for this CVE. ESX 7.0 is not in it either, and the advisory's 7.0 guidance covers only the Critical issues. If you only rent cloud VMs and do not manage ESX yourself, there is nothing for you to patch.
In plain words
The building's control room keeps a logbook of who opened which door. This flaw lets someone holding the master key do some jobs without them being written in the logbook. Without the master key it is useless, but once the key is stolen, you can no longer trace what was done.
How it works
It is classed as insufficient logging (CWE-778). Broadcom says a malicious administrator can perform certain operations that are not written to the logs. Which operations, and how logging is avoided, have not been made public. Broadcom rates it Low at CVSS 2.7, requiring high privileges (PR:H), with no effect on confidentiality or availability and a low effect on integrity. The flaw does not get anyone into ESX by itself. It matters after an attacker already holds admin rights, as a way to leave no trail. Because many virtual machines sit on one ESX host, gaps in its records make it easy to underestimate how far an intrusion went. CrowdStrike's blog of 2026-10-28 says WARP PANDA, a group it describes as China-nexus, used this flaw as a zero-day until early 2026 in several intrusions at US organizations, including legal-sector targets, where it had placed malware in vCenter environments. Broadcom credits Ian Barton of CrowdStrike with reporting the issue. There is no workaround; updating is the only fix. The same VMSA also covers a vCenter authentication bypass, CVE-2026-59309 (CVSS 9.8), and other issues.
How the attack unfolds
- The attacker gains admin rights on vCenter or ESX by some other means (CrowdStrike has not said how the initial access happened)
- They work on ESX as an administrator
- Because of this flaw, part of that work is never logged
- Later investigation finds gaps in the records, which makes it hard to tell what was done
What to do
- ESX admins: update to a fixed build from the VMSA-2026-0006 table (8.0 U3j or later, 9.0.2.0100 or later, 9.1.0.0 or later, VCF 5.2.4 for 5.x). There is no workaround
- ESX and vCenter admins: if the vCenter fixes in the same VMSA (CVE-2026-59309 and others) are not yet installed, apply them at the same time
- Organizations on ESX 7.0: no fix is listed for this CVE, so check with Broadcom and plan a move to a supported version
- Security teams: do not rely on ESX's own records alone. Compare vCenter events, logs shipped off the host and network records to review unusual admin activity
- Security teams: take stock of ESX and vCenter admin accounts and keep management interfaces away from the internet and the general office network
- US federal agencies: CISA's deadline is 2026-11-11
Not yet known
- Which operations escape logging (neither Broadcom nor CrowdStrike has said)
- How WARP PANDA first obtained admin rights
- Whether CISA's KEV listing rests on the same incidents CrowdStrike described
- Whether ESX 7.0 or the 8.0 U2 line is affected (neither appears in this CVE's table)
- Use in ransomware is marked "Unknown" in KEV
Sources
- VulnPulse の元記事 (CISA KEV)
- Broadcom VMSA-2026-0006
- CISA Known Exploited Vulnerabilities: CVE-2026-41709
- NVD: CVE-2026-41709
- CrowdStrike: 2026 Legal Threat Landscape Report (2026-10-28)
Written in our own words by VulnPulse from the original article and public sources. Check the sources for authoritative details. Updated:
| CVE | CVE-2026-41709 |
|---|---|
| Source | CISA Known Exploited Vulnerabilities |
| Fetched | 10/29/2026, 04:58 AM |
| Data | Markdown JSON |
On 10/29/2026, 04:58 AM, CISA Known Exploited Vulnerabilities published "[悪用確認] CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability" (type: Advisory). Severity is "Critical" (critical). Related technologies: VMware. CVE: CVE-2026-41709.