VMware called this ESXi bug low severity. Attackers used it to hide from the logs.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Wednesday, 28 October, CISA added VMware ESXi flaw CVE-2026-41709 to its exploited list with a two-week deadline. Disclosed on 29 July as a low-severity logging issue, it lets an attacker logged in as admin perform certain operations without being logged. CrowdStrike says the China-nexus group Warp Panda used it as a zero-day against US organizations, including law firms.
Why it matters
Your audit log is what you read after the break-in. If the attacker picked what it recorded, the investigation starts on a blank page, and a low score kept this patch at the bottom of the pile.
What to do
Upgrade ESXi to ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 or newer, and close the two critical July bugs, CVE-2026-59309 and CVE-2026-59310, in the same window.
My take
Lior Aharonov
Founder, 7IT Solutions
Severity scores rate the bug. Attackers rate the job it does for them, and hiding is worth a lot.
Sources
| SecurityWeek: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.