CISA adds VMware ESX flaw CVE-2026-41709 to KEV after CrowdStrike reports exploitation
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- VMware
- Product
- ESX
- First seen
Summary
CrowdStrike reported that the China-linked threat actor Warp Panda exploited CVE-2026-41709, an insufficient logging flaw in VMware ESX. CISA has added the vulnerability to its KEV catalog, and the item says it has a CVSS score of 2.7 and allows admin actions without logging.
If you use VMware
Apply the vendor's patch for VMware ESX that addresses CVE-2026-41709
Review ESX administrative activity for actions that may have gone unlogged
Confirm that audit logging is enabled and forwarded to a central location
Check CISA's KEV catalog guidance for federal or compliance deadlines
Check for and apply any VMware advisory for ESX as soon as one is published
Restrict management interface access to ESX hosts
What the sources say 7
· Mastodon: “In several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day.” Source
· Bluesky: “The U.S. CISA added CVE-2026-41709, an insufficient logging vulnerability in VMware ESX, to its KEV catalog after CrowdStrike reported its exploitation by the China-linked threat actor Warp Panda.” Source
· Bluesky: “Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls” Source
· Bluesky: “Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained” Source
· Bluesky: “Critical RCE via PHP2Shell & VMware ESX zero-day exploited.” Source
· Bluesky: “CISA warns of exploited VMware ESXi flaw (CVE-2026-41709).” Source
· Bluesky: “China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cyberse…” Source