The facts
The vulnerability concerns insufficient logging. It does not, by itself, establish that an unauthenticated attacker can remotely take over a server; Broadcom specifies existing administrative access as a prerequisite. [2][3]
Broadcom’s VMSA-2026-0006.2 advisory contains the affected-product and fixed-version matrix. For VMware ESX 8.0 it lists ESXi80U3j-25429389; other product branches require their corresponding listed updates. [2]
CISA’s catalog entry sets 11 November 2026 as the remediation due date for affected US federal civilian agencies. It directs operators to follow vendor mitigations and the applicable federal guidance; the date is not a universal legal deadline for all users. [1]
The Hacker News independently reported the catalog addition on 29 October. CISA’s listing confirms exploitation but does not provide a complete public list of affected organisations. [1][3]
Still unconfirmed
- The complete affected-organisation count and use in ransomware campaigns are not established by the checked primary sources.
Sources
References support the numbered facts above. Source checks: 29 Oct 2026, 20:56 UTC.
- Known Exploited Vulnerabilities catalog: CVE-2026-41709
US Cybersecurity and Infrastructure Security Agency · Primary source · 28 Oct 2026
Actual current JSON catalog read; the CVE’s dateAdded is 28 October, distinct from the 29 October catalog release timestamp. Ransomware use is listed as unknown.
- VMSA-2026-0006.2: VMware security advisory
Broadcom · Primary source · 19 Aug 2026
Actual section 3e and response matrix read. The July advisory, updated in August, covers several different CVEs; other entries’ remote-code-execution ratings are not assigned to this logging flaw.
- China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The Hacker News · Reporting · 29 Oct 2026
Actual article by Ravie Lakshmanan read. Campaign attribution is not independently established in this article; the report is used to corroborate the catalog addition and prerequisite.