medium severityConfidence highHistorical record

VMware ESX logging bypass let attackers run ESXi commands that never reached the logs, used as a zero-day and now on CISA KEV (CVE-2026-41709)

Direct answer

VMware ESX logging bypass let attackers run ESXi commands that never reached the logs, used as a zero-day and now on CISA KEV (CVE-2026-41709), also tracked as CVE-2026-41709 / VMware ESX insufficient logging / ESXi command logging bypass is a medium-severity threat campaign HOL Guard tracked from Jul 29, 2026 to Oct 28, 2026, verified against 6 primary sources and last reviewed Oct 28, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-41709 is an insufficient logging flaw in VMware ESX: an administrator can perform certain operations without them being logged. Broadcom fixed it in VMSA-2026-0006 on 2026-07-29 and rated it Low (CVSS 2.7), crediting Ian Barton of CrowdStrike. On 2026-10-28 CrowdStrike reported that the China-nexus adversary WARP PANDA, after deploying malware in victims' vCenter environments at US entities including the legal sector, exploited this ESXi command logging bypass as a zero-day in several cases as late as early 2026. CISA added it to KEV the same day with a 2026-11-11 due date. It grants no access on its own; its value to attackers is hiding post-compromise activity on the hypervisor, so local ESXi logs from affected periods may be incomplete.

Also tracked as CVE-2026-41709 · VMware ESX insufficient logging · ESXi command logging bypass · VMSA-2026-0006 · WARP PANDA ESXi zero-day

First observed
Jul 29, 2026
Last observed
Oct 28, 2026
Last reviewed
Oct 28, 2026
Tracking ended
Oct 28, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Broadcom and CrowdStrike have not disclosed which operations go unlogged or how the bypass works. CrowdStrike gives no indicator list in the report. CISA's KEV entry does not describe the exploitation it observed.

  • Requires administrator access to ESX; it is not an entry point
  • VMware Workstation and Fusion are not listed for this CVE
  • vCenter Server is not the vulnerable component for this CVE
  • ESXi 7.0 is not in the fixed-version matrix for this CVE

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not inspect or patch ESXi hosts or their logs; the fix is the VMSA-2026-0006 update plus remote syslog.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    Broadcom publishes VMSA-2026-0006 with fixes for CVE-2026-41709, rated Low (2.7).

    Source:Broadcom VMSA-2026-0006

  2. Disclosure

    CrowdStrike reports WARP PANDA exploited the ESXi command logging bypass CVE-2026-41709 as a zero-day as late as early 2026.

    Source:CrowdStrike 2026 Legal Threat Landscape Report

  3. Update

    CISA adds CVE-2026-41709 to KEV (catalog 2026.10.28), due 2026-11-11.

    Source:CISA KEV catalog entry for CVE-2026-41709

  4. Update

    HOL publishes operator guidance on patching and forwarding ESXi logs off-host.

    Source:HOL: VMware ESXi zero-day hid attacker commands from the logs

Publication clock: 8.1 hours from reviewed disclosure timestamp to HOL publication; 72-hour medium target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • VMware ESX@8.0 before ESXi80U3j-25429389; 9.0 before 9.0.2.0100-25595025; 9.1 before 9.1.0.0-25370933otherpackage

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

CVE-2026-41709 is an insufficient logging flaw in VMware ESX: an administrator can perform certain operations without them being logged. Broadcom fixed it in VMSA-2026-0006 on 2026-07-29 and rated it Low (CVSS HOL Guard tracked the campaign from Jul 29, 2026 to Oct 28, 2026.

No. Active tracking ended Oct 28, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 6 primary sources, names 1 reviewed artifact, and was last fully reviewed Oct 28, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Broadcom and CrowdStrike have not disclosed which operations go unlogged or how the bypass works. CrowdStrike gives no indicator list in the report. CISA's KEV entry does not describe the exploitation it observed.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-032A1B05