Organizations using VMware ESX should immediately apply the security update released by Broadcom/VMware. CISA's KEV catalog entry requires patching by the known deadline. Until a patch is applied, administrators should monitor audit logs for anomalies, restrict ESX host access to management networks, and review session and authentication logs for signs of tampering.
Quick answers
What is CVE-2026-41709?
Organizations using VMware ESX should immediately apply the security update released by Broadcom/VMware. CISA's KEV catalog entry requires patching by the known deadline. Until a patch is applied, administrators should monitor audit logs for anomalies, restrict ESX host access to management networks, and review session and authentication logs for signs of tampering.
How severe is CVE-2026-41709?
high
Is CVE-2026-41709 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-41709 be mitigated?
Organizations using VMware ESX should immediately apply the security update released by Broadcom/VMware. CISA's KEV catalog entry requires patching by the known deadline. Until a patch is applied, administrators should monitor audit logs for anomalies, restrict ESX host access to management networks, and review session and authentication logs for signs of tampering.
CVSS
—
Vendor
Broadcom
Published
Nov 2, 2026 · 03:34
Patch
Unknown / not confirmed
Affected products
VMware ESX
Mitigation
Organizations using VMware ESX should immediately apply the security update released by Broadcom/VMware. CISA's KEV catalog entry requires patching by the known deadline. Until a patch is applied, administrators should monitor audit logs for anomalies, restrict ESX host access to management networks, and review session and authentication logs for signs of tampering.
CISA has added CVE-2026-41709, a zero-day vulnerability in Broadcom VMware ESX, to its Known Exploited Vulnerabilities catalog. According to CrowdStrike, the flaw has been weaponized by a China-nexus threat actor tracked as Warp Panda in attacks targeting the U.S. legal sector. The exploitation is reported to reduce audit trail visibility, enabling persistent undetected access to VMware ESX environments.
