What happened
CISA added CVE-2026-41709 to the Known Exploited Vulnerabilities catalog on 2026-10-28 with confirmed in-the-wild exploitation. Broadcom VMware ESX has an insufficient-logging condition (CWE-778) permitting an admin-level actor to perform operations without them being logged.
Why it matters
Not AI-specific, but confirmed in-the-wild on the virtualization layer that hosts GPU/AI infrastructure — an attacker operating a bare-metal/ESX host can move against AI model-serving and training workloads while evading the audit trail that defenders rely on to detect a compromised cluster.
Attack vector
A malicious actor with admin access performs certain operations on the ESX host that are not recorded in logs, enabling stealthy actions that evade detection and forensic reconstruction of activity on the hypervisor hosting AI workloads.
Affected systems
Broadcom VMware ESX (see Broadcom security advisory 38017)
Mitigation
Apply the Broadcom ESX security patch and follow CISA BOD 26-04 guidance (federal due date 2026-11-11).