{"type":"bundle","id":"bundle--30877260-8b96-5d38-9953-a0ec7af11113","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--d3fa4294-658a-5e44-8448-009d267fef81","created":"2026-10-28T20:05:56.344Z","modified":"2026-10-28T20:05:56.344Z","name":"VMware ESX logging bypass let attackers run ESXi commands that never reached the logs, used as a zero-day and now on CISA KEV (CVE-2026-41709)","description":"CVE-2026-41709 is an insufficient logging flaw in VMware ESX: an administrator can perform certain operations without them being logged. Broadcom fixed it in VMSA-2026-0006 on 2026-07-29 and rated it Low (CVSS 2.7), crediting Ian Barton of CrowdStrike. On 2026-10-28 CrowdStrike reported that the China-nexus adversary WARP PANDA, after deploying malware in victims' vCenter environments at US entities including the legal sector, exploited this ESXi command logging bypass as a zero-day in several cases as late as early 2026. CISA added it to KEV the same day with a 2026-11-11 due date. It grants no access on its own; its value to attackers is hiding post-compromise activity on the hypervisor, so local ESXi logs from affected periods may be incomplete.","aliases":["CVE-2026-41709","VMware ESX insufficient logging","ESXi command logging bypass","VMSA-2026-0006","WARP PANDA ESXi zero-day"],"first_seen":"2026-07-29T00:00:00Z","last_seen":"2026-10-28T20:01:53Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"CISA KEV catalog entry for CVE-2026-41709","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709"},{"source_name":"Broadcom VMSA-2026-0006","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"},{"source_name":"NVD CVE-2026-41709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41709"},{"source_name":"CrowdStrike 2026 Legal Threat Landscape Report","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/"},{"source_name":"CrowdStrike: Threat Hunts for Shell Command Obfuscation on VMware ESX","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-hunts-for-shell-command-obfuscation-vmware-esx/"},{"source_name":"HOL: VMware ESXi zero-day hid attacker commands from the logs","url":"https://hol.org/blog/cve-2026-41709-vmware-esxi-logging-bypass-cisa-kev"}]}]}