Blind the Logs, Crash the VPN: Two Exploited Bugs This Week That Don't Steal Anything by Themselves

Disclosure: I work at Zscaler, and Cisco's firewalls and VPNs compete with what we sell. Keep that in mind for the second half of this post.

Two exploited bugs got attention this week, and neither one gives an attacker your data on its own. One makes them harder to see. The other takes your VPN offline. I think that pair says a lot about where attackers are spending their effort.

Blinding the Hypervisor: VMware ESX CVE-2026-41709

CISA added CVE-2026-41709, a Broadcom VMware ESX "insufficient logging" flaw, to the KEV catalog on October 28, with a federal deadline of November 11. Broadcom fixed it back in July.

The bug doesn't get you in. It assumes you're already an administrator, and lets you do certain things without them showing up in the logs. That sounds minor until you read who used it. CrowdStrike's 2026 Legal Threat Landscape Report says the China-nexus group it tracks as Warp Panda exploited it as a zero-day in early 2026 to cut down audit trail visibility during an intrusion. CrowdStrike describes the group as getting in through internet-facing edge devices, pivoting to vCenter, deploying malware like BRICKSTORM, and stealing Microsoft 365 session tokens.

Severity scores for this one vary depending on who you read, which is kind of the point. A scoring system that asks "what does this bug let you do?" will undersell a bug whose job is to hide what you already did.

Crashing the Front Door: Cisco ASA and FTD CVE-2026-76418

Cisco says it's aware of active exploitation of CVE-2026-76418 (CVSS 8.6) in Secure Firewall ASA and Threat Defense. A logic error in secondary authentication on tunnel groups lets an unauthenticated attacker send a crafted request to the SSL VPN and reload the device.

Credit to Cisco for being specific about exposure. You're affected if SSL VPN is enabled on an interface and secondary authentication is configured on a tunnel group, including DefaultWEBVPNGroup, which is easy to forget. Cisco has published fixed ASA and FTD releases.

Now the competitor's take, kept fair: a reboot isn't a breach. But for a lot of companies, the VPN is the only way in for remote workers, so crashing it on demand is a real outage. And a device reload is a moment of chaos that can help an attacker who's doing something else. This isn't a Cisco-only problem either. This month alone I've written about exploited bugs in Palo Alto, VeloCloud and unnamed firewall management planes. Internet-facing appliances are the most targeted gear on the planet, whoever makes them.

The Pattern

Put the two together and you get the playbook: get in through the edge, then make sure nobody can see you, and keep the defenders busy. That's why I don't love the way most teams triage. CVSS ranks bugs by what they do in isolation. Attackers chain them by what they do together.

What To Do

• VMware: apply Broadcom's July ESX patches if you haven't. Send ESX and vCenter logs to a system the hypervisor admin can't touch, and alert on gaps, not just on events.
• Cisco: upgrade to a fixed ASA or FTD release. Until then, Cisco's temporary mitigation is disabling secondary authentication on affected tunnel groups (check DefaultWEBVPNGroup too). Test it first, as Cisco says.
• Treat KEV as your priority list, not just the CVSS column. Exploited beats theoretical every time.
• Ask the architectural question. How much of your remote access and admin surface is on the internet? Every listening service is something to crash or exploit. Fewer of them means fewer weekends like this one.

Bottom Line

Not every dangerous bug steals data. Some just turn off your lights. Patch for what attackers are actually using, not what scores highest.

Sources: Help Net Security, Security Affairs, and CSO Online