CISA added CVE-2026-41709 in Broadcom VMware ESX to its KEV catalog after CrowdStrike said Warp Panda used it as a zero-day against the U.S. legal sector in early 2026.
Why a “low” score matters
It’s only CVSS 2.7, an insufficient-logging bug. But for an attacker who already has admin access, it lets certain actions skip the logs. CrowdStrike says Warp Panda hits edge devices with zero-days, dodges audit logging, steals cloud session tokens and registers rogue MFA devices. Broadcom fixed it back in July.
What to do
Patch ESX if you haven’t, and forward hypervisor logs off-box so a quiet admin can’t erase their tracks. A low CVSS doesn’t mean low risk.
God Bless, and Use the Source!
