#esxi

2 articles

CISA put a 2.7 on its exploited list. It is a logging gap in VMware ESX, which is the one thing CVSS cannot score

2026-10-29Security

CVE-2026-41709 lets an administrator run operations that are never logged. Broadcom rates it Low. It was added to the catalogue on 28 October, due 11 November, and the patch has been out since July.

Qilin and INC are pulling domain controller credentials out of the virtual disk, with the server still running

2026-10-27Security

Unit 42 says the significant change after exploiting a PAN-OS flaw is the direct pivot to the virtualisation layer. VPN gateway to vCenter to the ESXi host, then credentials out of a VMDK that the EDR inside never sees.