{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-032A1B05",
  "slug": "cve-2026-41709-vmware-esxi-logging-bypass-cisa-kev",
  "title": "VMware ESX logging bypass let attackers run ESXi commands that never reached the logs, used as a zero-day and now on CISA KEV (CVE-2026-41709)",
  "aliases": [
    "CVE-2026-41709",
    "VMware ESX insufficient logging",
    "ESXi command logging bypass",
    "VMSA-2026-0006",
    "WARP PANDA ESXi zero-day"
  ],
  "summary": "CVE-2026-41709 is an insufficient logging flaw in VMware ESX: an administrator can perform certain operations without them being logged. Broadcom fixed it in VMSA-2026-0006 on 2026-07-29 and rated it Low (CVSS 2.7), crediting Ian Barton of CrowdStrike. On 2026-10-28 CrowdStrike reported that the China-nexus adversary WARP PANDA, after deploying malware in victims' vCenter environments at US entities including the legal sector, exploited this ESXi command logging bypass as a zero-day in several cases as late as early 2026. CISA added it to KEV the same day with a 2026-11-11 due date. It grants no access on its own; its value to attackers is hiding post-compromise activity on the hypervisor, so local ESXi logs from affected periods may be incomplete.",
  "status": "published",
  "severity": "medium",
  "confidence": "high",
  "uncertainty": "Broadcom and CrowdStrike have not disclosed which operations go unlogged or how the bypass works. CrowdStrike gives no indicator list in the report. CISA's KEV entry does not describe the exploitation it observed.",
  "firstObservedAt": "2026-07-29T00:00:00Z",
  "lastObservedAt": "2026-10-28T20:01:53Z",
  "publishedAt": "2026-10-28T20:05:56.344Z",
  "reviewedAt": "2026-10-28T20:05:50.036Z",
  "expiresAt": "2026-10-28T20:01:53Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "cisa-kev",
      "label": "CISA KEV catalog entry for CVE-2026-41709",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709",
      "sourceType": "government",
      "observedAt": "2026-10-28T19:00:04Z"
    },
    {
      "id": "vmsa",
      "label": "Broadcom VMSA-2026-0006",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-07-29T00:00:00Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-41709",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41709",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-07-30T14:16:57Z"
    },
    {
      "id": "crowdstrike-legal",
      "label": "CrowdStrike 2026 Legal Threat Landscape Report",
      "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/",
      "sourceType": "research",
      "observedAt": "2026-10-28T00:00:00Z"
    },
    {
      "id": "crowdstrike-obfuscation",
      "label": "CrowdStrike: Threat Hunts for Shell Command Obfuscation on VMware ESX",
      "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-hunts-for-shell-command-obfuscation-vmware-esx/",
      "sourceType": "research",
      "observedAt": "2026-08-07T00:00:00Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: VMware ESXi zero-day hid attacker commands from the logs",
      "url": "https://hol.org/blog/cve-2026-41709-vmware-esxi-logging-bypass-cisa-kev",
      "sourceType": "other_primary",
      "observedAt": "2026-10-28T20:01:53Z"
    }
  ],
  "artifacts": [
    {
      "id": "vmware-esx",
      "artifactClass": "package",
      "ecosystem": "other",
      "name": "VMware ESX",
      "version": "8.0 before ESXi80U3j-25429389; 9.0 before 9.0.2.0100-25595025; 9.1 before 9.1.0.0-25370933",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "vmsa-2026-0006-published",
      "occurredAt": "2026-07-29T00:00:00Z",
      "eventType": "vendor_action",
      "summary": "Broadcom publishes VMSA-2026-0006 with fixes for CVE-2026-41709, rated Low (2.7).",
      "sourceIds": [
        "vmsa"
      ]
    },
    {
      "id": "crowdstrike-zero-day-report",
      "occurredAt": "2026-10-28T12:00:00Z",
      "eventType": "disclosure",
      "summary": "CrowdStrike reports WARP PANDA exploited the ESXi command logging bypass CVE-2026-41709 as a zero-day as late as early 2026.",
      "sourceIds": [
        "crowdstrike-legal"
      ]
    },
    {
      "id": "cisa-kev-add",
      "occurredAt": "2026-10-28T19:00:04Z",
      "eventType": "other",
      "summary": "CISA adds CVE-2026-41709 to KEV (catalog 2026.10.28), due 2026-11-11.",
      "sourceIds": [
        "cisa-kev"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-10-28T20:01:53Z",
      "eventType": "other",
      "summary": "HOL publishes operator guidance on patching and forwarding ESXi logs off-host.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-esxi",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not inspect or patch ESXi hosts or their logs; the fix is the VMSA-2026-0006 update plus remote syslog."
    }
  ],
  "policies": [],
  "limitations": [
    "Requires administrator access to ESX; it is not an entry point",
    "VMware Workstation and Fusion are not listed for this CVE",
    "vCenter Server is not the vulnerable component for this CVE",
    "ESXi 7.0 is not in the fixed-version matrix for this CVE"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-41709-vmware-esxi-logging-bypass-cisa-kev/corrections"
}