SZB-25bdb154f7
CISA warns VMware ESXi logging bypass CVE-2026-41709 is actively exploited
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Broadcom
- Product
- VMware ESXi
- First seen
Summary
CISA warns that a logging bypass flaw in VMware ESXi, CVE-2026-41709, is being actively exploited. Per the post, the flaw was used as a zero-day in espionage attacks against US law firms, with the attackers linked to China; attacker activity may not appear in logs.
If you use Broadcom
Update ESXi to ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, or ESXi80U3j-25429389 as applicable
Change ESXi administrator passwords
Limit management interfaces to trusted networks
Review existing configurations and access for signs of compromise
What the sources say 1
· Mastodon: “CISA warns of active exploitation of a logging bypass vulnerability (CVE-2026-41709) that Chinese-linked hackers used as a zero-day to hide their activity during espionage attacks against U.S. law firms.” Source