CISA Adds VMware ESX Zero-Day Vulnerability (CVE-2026-41709) to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added a VMware ESX flaw, tracked as CVE-2026-41709, to its Known Exploited Vulnerabilities catalog. Despite a low Broadcom severity score of 2.7, this zero-day vulnerability allows an attacker with administrator rights to perform certain operations on an ESX host without leaving a log record. CrowdStrike attributes its exploitation in early 2026 to the China-nexus group Warp Panda. Federal agencies are directed to remediate by November 11, 2026.