Sadeem IT Solutions
31 Oct 2026

Invisible in the hypervisor: attackers use VMware ESX flaw CVE-2026-41709 to cover their tracks

A low-rated VMware flaw is being actively exploited: attackers use it to hide admin actions on ESX servers. What to patch and check now.

vmware-esx-logging-luecke-cve-2026-41709

A vulnerability rated "low" has been on the US cybersecurity agency CISA's list of actively exploited vulnerabilities since 28 October. CVE-2026-41709 in VMware ESX has a CVSS score of just 2.7. Attackers still used it deliberately so that what they did on the server would not show up in the logs. Broadcom released the fix back in July. If you have not updated your ESX servers since then, do it now and check whether anything happened on the hosts unnoticed.

What happened

VMware ESX (formerly ESXi) is the hypervisor that runs all the virtual servers in many companies: file servers, ERP, mail servers, domain controllers. CVE-2026-41709 affects logging. An attacker with administrator rights on the host can carry out certain actions without them being recorded in the logs. On its own, the flaw does not give anyone access. But an attacker who is already in can use it to cover their tracks. That is why it is rated low.

According to the security vendor CrowdStrike, the China-linked group Warp Panda used the flaw as a zero-day in early 2026, before a fix existed. Its victims included law firms in the US. Based on the published reports, the attacks went roughly like this:

  • Initial access through firewalls and VPN gateways reachable from the internet
  • Moving on to VMware vCenter and setting up persistent backdoors (including the malware BRICKSTORM)
  • Covering tracks on the ESX hosts with CVE-2026-41709
  • Stealing session tokens to access Microsoft 365 without a password prompt
  • In at least one case, registering its own MFA device so access survived a password change

On 28 October 2026, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. US federal agencies must apply the fix by 11 November.

Who is affected

ESX hosts that have not yet been updated to the builds in Broadcom's security advisory VMSA-2026-0006 (July 2026) are affected. The flaw is fixed in, among others:

  • ESX 8.0: ESXi80U3j-25429389 or later
  • ESX 9.0 (VCF/vSphere Foundation): ESXi-9.0.2.0100-25595025
  • ESX 9.1 (VCF/vSphere Foundation): ESXi-9.1.0.0-25370933 or later
  • VMware Cloud Foundation 5.x: 5.2.4

The same advisory fixes several far more dangerous flaws as well. They include two critical bugs in vCenter (CVSS 9.8) and a virtual machine escape through the VMXNET3 network adapter (CVSS 9.3). For ESX 8.0 we therefore recommend going straight to 8.0 U3k (ESXi80U3k-25595708), and to 8.0 U3k for vCenter 8.0. These builds cover every flaw in the advisory.

Broadcom lists no workaround. For ESX 7.0, it refers customers to extended support contracts. Many smaller companies are stuck here. Since the Broadcom takeover, customers without an active subscription no longer receive security updates, even if they own a perpetual licence.

What you should do now

  1. Check versions: Find out which build every ESX host and vCenter is running. Hosts without the builds listed above come first.
  2. Update: Bring ESX and vCenter up to the current patch level, which for 8.0 means U3k. Plan a maintenance window with vMotion or a short downtime.
  3. Send logs off the host: Forward ESX and vCenter logs via syslog to a central system that host administrators cannot change. An update does not make the local logs of an already compromised host trustworthy again.
  4. Lock down management: vCenter and ESX interfaces must never be reachable from the internet. Turn off SSH on the hosts when it is not needed, and allow access to vCenter only with multi-factor sign-in.
  5. Check Microsoft 365: Review the registered MFA methods of your administrators and key accounts. If anything looks suspicious, end all active sessions. Changing the password alone is not enough if a foreign MFA device is registered.
  6. Update your firewall and VPN: This is where such attacks start. Keep your edge devices up to date and review who can access them.

If there are signs of a compromise, such as unexplained admin logins, unknown files on the hosts or new MFA devices, get help with a forensic investigation before you rebuild any systems.

How Sadeem helps

We take care of patching your VMware environment as a one-off project or on an ongoing basis as part of our managed operations: inventory, updates in planned maintenance windows, central logging, monitoring and backups hosted in Germany or the EU. If needed, we also check your Microsoft 365 tenant for suspicious sign-ins and unknown MFA devices.

If missing updates or rising licence costs have you thinking about switching, we will show you what a move to Proxmox VE could look like. The platform is open source, has no licence traps, and security updates are available without a subscription. We plan and carry out the migration with you and can keep running the environment afterwards.

Get in touch, the initial consultation is free.

Sources

SecurityVMwareMicrosoft 365Zero-Day