CYBUNKR

VMware ESX and vCenter:a second flaw from VMSA-2026-0006 is now exploited

Published

CISA has added CVE-2026-41709, which lets an ESX administrator act without being logged, to its exploited list. A critical vCenter flaw from the same July advisory has been exploited since August, including by ransomware. What to patch and check.

If you run VMware ESX (ESXi) or vCenter, check that Broadcom's July updates are on. On 28 October CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog. It is a flaw in ESX that lets a malicious administrator do certain things without them being logged (Broadcom). Broadcom rates it low, 2.7 out of 10, because the attacker already needs admin access. The danger is what it hides: an intruder on your hosts leaving fewer traces.

It is one of five flaws fixed in VMSA-2026-0006, published on 29 July. Another one, CVE-2026-59310 in vCenter, rated 9.8, lets an attacker with network access to vCenter run code without logging in. CISA has listed it as exploited since 18 August and records it as known to be used in ransomware campaigns.

What is affected

  • CVE-2026-59310 (9.8): directory traversal in the vCenter syslog server, leading to code execution by anyone who can reach vCenter on the network.
  • CVE-2026-59309 (9.8): authentication bypass in the vCenter VMware Directory Service.
  • CVE-2026-47876 (9.3): out-of-bounds write in the VMXNET3 virtual network adapter. An attacker with admin rights inside a virtual machine could run code on the ESX host.
  • CVE-2026-41703 (up to 7.6): out-of-bounds read in ESX, Workstation and Fusion, mostly a denial-of-service risk.
  • CVE-2026-41709 (2.7): insufficient logging in ESX, the one added to CISA's list this week. Reported by CrowdStrike.

Broadcom says you are affected if you run any version of ESX, vCenter, Workstation, Fusion, VMware Cloud Foundation, vSphere Foundation or Telco Cloud Platform/Infrastructure older than the fixed versions, and that there are no workarounds (Broadcom FAQ).

What has been seen so far

A snapshot from 29 October:

  • CISA's assessment in the CVE record rates exploitation of CVE-2026-41709 as “active”. It gave US federal agencies until 11 November and records ransomware use as “unknown” (KEV).
  • For CVE-2026-59310 CISA records ransomware use as “known” and marked it for forensic triage, meaning agencies should also look for signs of compromise (KEV).
  • Neither CISA nor Broadcom has said who is exploiting CVE-2026-41709 or whether it is being combined with the vCenter flaws.

What to do

  • Patch vCenter first if it is behind: 8.0 U3k, 9.0.2.0100 or 9.1.0.0300 (Broadcom). Version 7.0 patches are only for customers with extended support; on 7.0 without it, plan the upgrade now.
  • Patch ESX: ESXi 8.0 U3k (ESXi80U3k-25595708), 9.0.2.0100 or 9.1.0.0200 cover all the ESX flaws in the advisory; VMware Cloud Foundation 5.x has 5.2.4 (Broadcom).
  • Keep vCenter and ESX management off the internet and reachable only from an admin network or VPN. The vCenter flaws need network access to it.
  • Review admin accounts: CVE-2026-41709 needs an administrator, so check who has admin on your hosts and vCenter, remove accounts you don't recognise, and turn on multi-factor authentication where you can.
  • Send logs off the host to a separate log server or SIEM, so an intruder on ESX can't quietly edit the record. Don't rely on host logs alone when checking back.
  • If an IT provider runs your servers, ask which ESX and vCenter builds you are on and whether VMSA-2026-0006 is installed.

How we can help

If you think your virtual servers have been accessed, our Incident Response service can help, or get in touch.

Sources