CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability

The CVE record describes the flaw this way: VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.[2]HOL Guard reports that Broadcom fixed it in VMSA-2026-0006 on 2026-07-29 and rated it Low (CVSS 2.7), crediting Ian Barton of CrowdStrike.[3] The Hacker News reported at the time that Broadcom noted that it has found no evidence to suggest any of these issues have been exploited[4].In its 2026 Legal Threat Landscape Report, CrowdStrike says that in several of these cases, and as late as early 2026, the adversary exploited[1] the flaw. According to HOL Guard, this happened after WARP PANDA had deployed malware in victims' vCenter environments at US entities including the legal sector[3].HOL Guard reports that CISA added it to KEV the same day with a 2026-11-11 due date.[3] The site cve-security.com reports that CISA lists ransomware use as "Unknown"[2].HOL Guard says the bug grants no access on its own; its value to attackers is hiding post-compromise activity on the hypervisor[3]. It adds that Broadcom and CrowdStrike have not disclosed which operations go unlogged or how the bypass works.[3]The Hacker News reports that fixes shipped in VMware Cloud Foundation and VMware vSphere Foundation versions ESXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025, and VMware ESX ESXi80U3j-25429389[4].Security firm Hard2bit advised that, because of this flaw, defenders should "don't rely on vCenter's own logs alone to catch abuse."[5]