# CISA Adds VMware ESX Flaw to KEV

On October 28, 2026, CISA added the VMware ESX logging vulnerability CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog, even though it has a CVSS score of 2.7. Federal civilian agencies must remediate the flaw by November 11, 2026—nine days from the current date—under the applicable KEV deadline. The recommended measures include applying Broadcom advisory VMSA-2026-0006 and forwarding hypervisor logs to an external, tamper-resistant system. The signal identifies no related solicitation or contract award.

- Federal contractors operating or supporting affected systems should verify ESX hosts are patched and hypervisor logs are forwarded as advised, and confirm any applicable contract-specific security obligations with their government customers.
- Procurement and security teams should account for the November 11 agency remediation deadline when coordinating affected-system access, patching, and evidence of remediation.
- The KEV listing makes the flaw relevant to federal risk management despite its low CVSS score; companies supporting federal systems may need to coordinate remediation activities with agency stakeholders.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 02, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Vendors
- Broadcom (Publisher of VMware ESX and issuer of security advisory VMSA-2026-0006)
- CrowdStrike (Threat-intelligence provider reporting on the exploitation)

### Sources
- [CVE-2026-41709: VMware ESX CVSS 2.7 Zero-Day [2026]](https://tech-insider.org/vmware-esx-cve-2026-41709-cvss-2-7-zero-day-warp-panda-2026) - https://tech-insider.org/