US cyber agency sets November 11 deadline to fix exploited VMware flaw

The US Cybersecurity and Infrastructure Security Agency (CISA) added a VMware ESX logging flaw to its Known Exploited Vulnerabilities catalog on October 28, 2026. Federal Civilian Executive Branch agencies running affected software must complete the required remediation by November 11.

Broadcom had already published its advisory and fixes for the flaw, CVE-2026-41709, on July 29, 2026. CISA’s listing follows CrowdStrike’s finding that the China-linked hacking group Warp Panda exploited it in intrusions affecting US organisations, including legal-sector targets.

How the flaw can leave some administrator actions unlogged

Broadcom says the flaw allows a malicious administrator to perform certain operations without recording them in system logs. Exploitation therefore requires existing administrator access: it helps an attacker conceal activity after gaining access, rather than providing the initial way in. Broadcom rates the flaw low severity, with a CVSSv3 technical severity score of 2.7.

What CrowdStrike found in the intrusions

CrowdStrike’s 2026 Legal Threat Landscape Report examines activity observed from September 1, 2025 through August 31, 2026, with analysis supplied by its Intelligence team. The company said Warp Panda deployed malware in victims' VMware vCenter environments and exploited the logging flaw in several intrusions, as late as early 2026, as a zero-day—before patches were available. Its public account does not name the affected legal-sector organisations or give a count for them.

CrowdStrike said in its report, shared with The Hacker News, that Warp Panda exploits internet-facing edge devices for initial access, then moves into VMware vCenter environments and installs custom malware to retain access. Some intrusions also sought user-session tokens—credentials for an already signed-in session—to access Microsoft 365 without triggering alerts tied to login credentials.

CrowdStrike said law firms are valuable intelligence targets because they hold client communications, merger-and-acquisition materials and litigation strategies, alongside access across clients.

Earlier in October 2026, Mandiant also attributed exploitation of a different vulnerability to Warp Panda: CVE-2026-102764, a critical flaw in BeyondTrust Remote Support’s checks on the origin of requests.

Which updates administrators need

Broadcom directs administrators to install the fixes in its CVE-2026-41709 response matrix. Its July 29 advisory lists the affected software branches and remediation below, with no workaround available.

CISA requires agencies to apply vendor mitigations while following its directive BOD 26-04 on prioritising security updates by risk, along with its Forensics Triage Requirements for examining potentially compromised systems. Agencies must also assess each asset’s internet exposure and follow the directive’s applicable guidance for cloud services.

Installing Broadcom’s listed fixes addresses the logging vulnerability; leaving affected software unpatched preserves the opportunity for an administrator-level attacker to perform some operations without logs. Federal civilian executive agencies have until November 11, 2026 to complete CISA’s required action and must discontinue use of the product if mitigations are unavailable.