[悪用確認] CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability

VulnPulse 해설

VMware ESX flaw that leaves some admin actions unrecorded is added to CISA KEV after zero-day use

CISA added CVE-2026-41709 to its exploited-vulnerabilities list on 2026-10-28. With administrator rights on ESX, an attacker can carry out certain actions that never reach the logs. Broadcom fixed it in July in VMSA-2026-0006.

영향을 받는 대상

Organizations that run VMware ESX (ESXi) themselves. Broadcom's advisory lists these fixed builds: ESXi80U3j-25429389 for ESX 8.0, ESXi-9.0.2.0100-25595025 for ESX 9.0.x, ESXi-9.1.0.0-25370933 for ESX 9.1.x, 5.2.4 for VMware Cloud Foundation 5.x, and KB449886 for Telco Cloud Platform 5.0.x and 5.1.x. vCenter, Workstation and Fusion do not appear in the table for this CVE. ESX 7.0 is not in it either, and the advisory's 7.0 guidance covers only the Critical issues. If you only rent cloud VMs and do not manage ESX yourself, there is nothing for you to patch.

쉽게 말하면

The building's control room keeps a logbook of who opened which door. This flaw lets someone holding the master key do some jobs without them being written in the logbook. Without the master key it is useless, but once the key is stolen, you can no longer trace what was done.

작동 방식

It is classed as insufficient logging (CWE-778). Broadcom says a malicious administrator can perform certain operations that are not written to the logs. Which operations, and how logging is avoided, have not been made public. Broadcom rates it Low at CVSS 2.7, requiring high privileges (PR:H), with no effect on confidentiality or availability and a low effect on integrity. The flaw does not get anyone into ESX by itself. It matters after an attacker already holds admin rights, as a way to leave no trail. Because many virtual machines sit on one ESX host, gaps in its records make it easy to underestimate how far an intrusion went. CrowdStrike's blog of 2026-10-28 says WARP PANDA, a group it describes as China-nexus, used this flaw as a zero-day until early 2026 in several intrusions at US organizations, including legal-sector targets, where it had placed malware in vCenter environments. Broadcom credits Ian Barton of CrowdStrike with reporting the issue. There is no workaround; updating is the only fix. The same VMSA also covers a vCenter authentication bypass, CVE-2026-59309 (CVSS 9.8), and other issues.

공격 흐름

1. The attacker gains admin rights on vCenter or ESX by some other means (CrowdStrike has not said how the initial access happened)
2. They work on ESX as an administrator
3. Because of this flaw, part of that work is never logged
4. Later investigation finds gaps in the records, which makes it hard to tell what was done

해야 할 일

• ESX admins: update to a fixed build from the VMSA-2026-0006 table (8.0 U3j or later, 9.0.2.0100 or later, 9.1.0.0 or later, VCF 5.2.4 for 5.x). There is no workaround
• ESX and vCenter admins: if the vCenter fixes in the same VMSA (CVE-2026-59309 and others) are not yet installed, apply them at the same time
• Organizations on ESX 7.0: no fix is listed for this CVE, so check with Broadcom and plan a move to a supported version
• Security teams: do not rely on ESX's own records alone. Compare vCenter events, logs shipped off the host and network records to review unusual admin activity
• Security teams: take stock of ESX and vCenter admin accounts and keep management interfaces away from the internet and the general office network
• US federal agencies: CISA's deadline is 2026-11-11

아직 밝혀지지 않은 점

• Which operations escape logging (neither Broadcom nor CrowdStrike has said)
• How WARP PANDA first obtained admin rights
• Whether CISA's KEV listing rests on the same incidents CrowdStrike described
• Whether ESX 7.0 or the 8.0 U2 line is affected (neither appears in this CVE's table)
• Use in ransomware is marked "Unknown" in KEV

출처

• VulnPulse の元記事 (CISA KEV)
• Broadcom VMSA-2026-0006
• CISA Known Exploited Vulnerabilities: CVE-2026-41709
• NVD: CVE-2026-41709
• CrowdStrike: 2026 Legal Threat Landscape Report (2026-10-28)

원문 기사와 공개 정보를 바탕으로 VulnPulse가 자체적으로 정리한 해설입니다. 정확한 내용은 출처를 확인하세요. 업데이트: 2026. 10. 29. 오후 02:47