SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
10 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-41709 · CVSS 2.7

Broadcom VMware ESX: security flaw used in attacks

AFFECTSBroadcom VMware ESXVMware Cloud FoundationVMware Vsphere FoundationVMware EsxVMware Telco Cloud Platform

OFFICIAL NAME: Broadcom VMWare ESX Insufficient Logging Vulnerability

WHAT IT IS · SERVERS AND BACKUPSIt runs or protects many systems at once, including your backups.

DO THIS FIRSTPatch it and keep its admin access off the internet. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 103 days old, so many systems are likely still unpatched.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. The confirmation is 14 days old. 5 products are affected.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
NONE KNOWN
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 6 INDEPENDENT SOURCES

    CVE-2026-41709 discussed publicly (CIRCL sighting). CVE-2026-41709 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Exploitation of CVE-2026-41709 reported (CIRCL sighting). Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-41709 published
  2. EXPLOIT CODE PUBLIC
    NOT YET
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 90 days after disclosure. CISA listed it 90 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. CISA set Nov 11, 2026 as the deadline for US federal agencies. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. JUL 30, 2026
    CISA Vulnrichment marks CVE-2026-41709 as actively exploited
  2. Attack activity. OCT 27, 2026
    Broadcom VMWare ESX Insufficient Logging Vulnerability
  3. OCT 28, 2026
    VMware security advisory (AV26-763) – Update 2
  4. OCT 28, 2026
    CVE-2026-41709 discussed publicly (CIRCL sighting) (56 reports, latest NOV 8)
  5. OCT 28, 2026
    China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
  6. Attack activity. OCT 28, 2026
    Exploitation of CVE-2026-41709 reported (CIRCL sighting)
  7. OCT 29, 2026
    Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
  8. OCT 29, 2026
    U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog
  9. OCT 29, 2026
    Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-41709 discussed publicly (CIRCL sighting), NOV 8
  2. [2] Help Net Security: Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls, OCT 29
  3. [3] Security Affairs: U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog, OCT 29
  4. [4] SecurityWeek: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day, OCT 29
  5. [5] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-41709 reported (CIRCL sighting), OCT 28
  6. [6] The Hacker News: China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility, OCT 28
  7. [7] Canadian Centre for Cyber Security: VMware security advisory (AV26-763) – Update 2, OCT 28
  8. [8] CISA Known Exploited Vulnerabilities: Broadcom VMWare ESX Insufficient Logging Vulnerability, OCT 27
  9. [9] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-41709 as actively exploited, JUL 30
  10. [10] CIRCL Vulnerability-Lookup sightings: 55 more reports