The US Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in Broadcom's VMware ESX to its Known Exploited Vulnerabilities (KEV) catalogue, meaning the agency has evidence it is being exploited in the wild. The flaw, tracked as CVE-2026-41709, was added on 28 October 2026, and US federal civilian agencies must remediate it by 11 November 2026 under Binding Operational Directive 26-04.

The fix has existed since July

The weakness is classed as insufficient logging (CWE-778). In plain terms, a person who already has administrator access to an ESX host could carry out certain operations without those actions being recorded in the logs. That matters far more than the flaw's low severity rating of 2.7 out of 10 might suggest: ESXi hosts are high-value targets, and an attacker who can act without leaving a log trail is much harder to detect, investigate, or evict. CISA does not name who is exploiting it, and lists known ransomware use as unknown.

Broadcom disclosed and fixed the issue on 29 July 2026 in advisory VMSA-2026-0006. Fixed builds include ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389, along with VMware Cloud Foundation 5.2.4. Organisations running affected versions should apply the vendor update, following Broadcom's mitigation instructions for their build. CISA's standard advice applies: check which assets are exposed, apply the fix, and stop using the product if no mitigation is available. Two practical steps cost little and help a lot — keep ESXi management interfaces off the general office network with multi-factor authentication on vCenter, and send ESXi and vCenter logs to a separate log server, so a compromised host cannot quietly erase its own trail.

Sources: CISA, The Circuitry (Broadcom VMSA-2026-0006).