CISA has added CVE-2026-41709 in VMware ESX to its Known Exploited Vulnerabilities catalog. The flaw scores as "low" but was used to keep attacker activity out of the audit logs.
On 28 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41709, a flaw in the VMware ESX virtualisation platform, to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability carries a CVSS score of 2.7 — "low" on the standard scale. According to The Hacker News, it was nonetheless used as a zero-day in a targeted espionage campaign from early 2026 onwards.
What it does is simple enough: an attacker who already holds administrative rights can perform certain operations on an ESX host without those operations reaching the audit log. The flaw grants no initial access and no privilege escalation on its own. Its only function is to make sure the attacker leaves no trace behind.
Why the low score is misleading
A CVSS score measures the technical severity of a flaw. It says nothing about where that flaw sits in an attack chain. Here, the 2.7 issue was the clean-up link. The China-nexus group CrowdStrike tracks as Warp Panda — reported elsewhere as Clay Typhoon and VerdantBamboo — gets in through vulnerabilities in internet-facing edge devices, then pivots into VMware vCenter environments and deploys the BRICKSTORM and SharpStorm malware families. CVE-2026-41709 is what kept that movement out of the audit trail.
Mandiant has reported that the same group also used CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support as a zero-day. The pattern is clear: the high-scoring flaw opens the door, the low-scoring one turns off the lights behind it. Organisations that prioritise patching strictly by CVSS leave the second kind at the bottom of the queue for months.
What this means for SMEs
ESXi is by far the most common virtualisation platform we encounter in Turkish SMEs. In most manufacturing plants, logistics firms, shipping agencies and office-tower tenants, the entire workload runs on one or two ESXi hosts: the domain controller, the ERP system, the file server, accounting and, very often, the backup server too. That concentration turns the virtualisation layer into a single high-value target.
Two practical problems follow. First, ESXi hosts are usually left exactly as installed, on an "if it works, don't touch it" basis. The fixed builds Broadcom published with its July 2026 advisory — ESXi80U3j-25429389 for ESX 8.0, ESXi-9.0.2.0100-25595025 for 9.0 and ESXi-9.1.0.0-25370933 for 9.1 — have still not been applied in many organisations. Second, ESXi logs usually sit on the host's own disk. As long as the log lives on the server it is meant to protect, whoever owns the server owns the log.
There is a compliance angle too. Article 12 of Turkey's Personal Data Protection Law No. 6698 requires data controllers to take appropriate technical and organisational measures, and a breach notification to the Board is expected to set out the scope of the incident. Without complete audit records, the question "what data was accessed, and when" simply cannot be answered.
What Kamer Bilişim recommends
- Verify the build number on your virtualisation hosts this week. Compare the build shown in the ESXi console against the fixed versions listed above. If it is older, schedule a maintenance window and commit to the update — a hypervisor patch should not be postponed.
- Move ESXi logs off the host. Use the ESXi syslog target setting to forward records to a separate log server or a collector on the backup network. This limits the impact of logging-bypass flaws like CVE-2026-41709 and preserves your ability to investigate afterwards.
- Isolate the management interface and narrow access to it. ESXi and vCenter interfaces should never face the internet. Place them on a dedicated management VLAN and allow access only from specific addresses, via a jump host protected by multi-factor authentication.
To review the version status, log handling and backup architecture of your virtualisation estate together, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: The Hacker News, CISA KEV Catalog, GBHackers
Source: The Hacker News