The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector.
The vulnerability in question is CVE-2026-41709 (CVSS score: 2.7), an insufficient logging vulnerability that could permit a malicious actor with admin access to perform certain operations without being logged.
In an advisory released in July 2026, Broadcom revealed that the issue was addressed in the following versions –
- VMware Cloud Foundation SXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025
- VMware vSphere Foundation SXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025
- VMware ESX ESXi80U3j-25429389
- VMware Cloud Foundation 5.2.4
- VMware Telco Cloud Platform…
