The US cybersecurity agency CISA on Wednesday warned that hackers have been exploiting another VMware ESXi vulnerability in attacks. Tracked as CVE-2026-41709, the exploited flaw is described as a low-severity insufficient logging issue. It allows attackers logged in as administrators to perform certain operations without being logged. The security defect was disclosed on July 29 alongside three critical and one high-severity bug in VMware vCenter, ESXi, Workstation, and Fusion. VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 and newer releases contain the relevant patches. CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within the next two weeks. CISA did not provide details on the observed…