CISA added CVE-2026-41709, a VMware ESX logging flaw scored just 2.7 on the CVSS scale, to its Known Exploited Vulnerabilities catalog on October 28, 2026, according to Cyber Security News. Federal civilian agencies have until November 11 to fix it. The score says low risk. The actor behind the attacks, a China-nexus group CrowdStrike tracks as WARP PANDA, used the bug as a zero-day against US legal-sector targets as late as early 2026.
CVE-2026-41709: VMware ESX CVSS 2.7 Zero-Day [2026]
![CVE-2026-41709: VMware ESX CVSS 2.7 Zero-Day [2026]](https://i3.wp.com/tech-insider.org/wp-content/uploads/2026/11/vmware-esx-cve-2026-41709-cvss-2-7-zero-day-warp-panda-2026-gen.webp?ssl=1 "CVE-2026-41709: VMware ESX CVSS 2.7 Zero-Day [2026]")
