CISA has added a low-rated VMware ESXi logging flaw to its exploited-vulnerabilities list, after CrowdStrike tied it to a China-nexus group that used it to work inside vCenter without leaving entries behind.
What happened
CVE-2026-41709 is an insufficient logging vulnerability in VMware ESX. Broadcom rates it 2.7 and describes an administrator who can perform certain operations without them being logged. CISA added it to the Known Exploited Vulnerabilities catalog on 28 October 2026.
CrowdStrike reported the same week that Warp Panda, a China-nexus actor, used the flaw as a zero-day in intrusions at US organisations including law firms. The group typically enters through internet-facing edge devices and pivots to vCenter, where it has deployed malware families including BrickStorm and TetanusStorm. According to CrowdStrike, the logging flaw cut audit visibility in several of those intrusions, as late as early 2026.
The advisory that fixed it, VMSA-2026-0006, also fixed two critical vCenter bugs: CVE-2026-59309, a 9.8 authentication bypass in the VMware Directory Service, and CVE-2026-59310, a 9.8 directory traversal in the vCenter Syslog server that leads to code execution. One incident-response firm reported roughly 360 web-accessible vCenter servers compromised through the second bug in August.
Who is affected
- ESXi 9.1.x below ESXi-9.1.0.0-25370933, 9.0.x below ESXi-9.0.2.0100-25595025, and 8.0 below ESXi80U3j-25429389.
- VMware Cloud Foundation 5.x below 5.2.4. ESXi 7.0 receives fixes only under an extended support contract.
- Estate where vCenter is reachable from the internet, which is the exposure both critical vCenter flaws need.
What to do now
Patch ESXi and vCenter to the fixed builds, then treat any vCenter that was internet-facing as possibly compromised.
- Upgrade ESXi and vCenter to the builds listed in VMSA-2026-0006, and confirm that 7.0 hosts have a support path.
- Close vCenter, the ESXi host client and the Syslog service to the internet, and allow management only from a jump host or VPN.
- Because the logging gap hides administrator actions, pull evidence from outside vCenter: remote syslog, network flow data and backup job history.
- Rotate vCenter and ESXi credentials, and check for unfamiliar local accounts, scheduled tasks and VM snapshots.
What this means for South African businesses
A 2.7 score is the reason this one gets skipped in patch meetings, and that is the wrong read: the score measures the flaw in isolation, not what an intruder does with it once inside. For an SME running two or three hosts, a vCenter console on a public IP is the whole estate, and a tampered audit trail often means the first sign of a breach is encrypted backups. If nobody has checked which management interfaces answer from the internet, that check is worth more this week than another vulnerability scan.
Source: SecurityWeek - Chinese hackers quietly used low-severity ESXi logging flaw as zero-day.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.