Science & Tech · Cybersecurity · 3 hrs ago
China-Linked Hackers Used VMware ESXi Logging Flaw in US Attacks
A China-linked group called Warp Panda exploited a VMware ESXi flaw in attacks on US organizations, including law firms.
The flaw, CVE-2026-41709, affects VMware software used to run virtual machines and was used as a zero-day, meaning it was exploited before the attacks were publicly known.
It lets administrators perform some actions without those actions being logged, making it harder for defenders to see what happened.
The flaw does not itself give an attacker administrator access; CrowdStrike says Warp Panda typically first breaks into internet-facing devices and then moves into VMware systems.
CISA added the flaw to its list of vulnerabilities known to be exploited and urged US federal civilian agencies to install fixes by November 11, 2026.
Patching can close the logging gap, but the flaw is part of a wider pattern of attacks involving VMware systems.
CrowdStrike describes Warp Panda as a continuing cyber-espionage threat to US organizations, and agencies are expected to meet CISA’s patch deadline.
CISA added VMware vulnerability CVE-2026-41709 to its Known Exploited Vulnerabilities catalog after reports that it was used in attacks.
CrowdStrike said China-nexus threat actor Warp Panda exploited the flaw as a zero-day in attacks on U.S. organizations, including legal-sector targets.
The low-severity flaw lets an administrator carry out certain operations without those actions being logged, reducing audit-trail visibility.
CrowdStrike said the group used the flaw in intrusions in 2025 and as late as early 2026.
CISA urged federal agencies to apply fixes by November 11, 2026.
- Who
- China-nexus threat actor Warp Panda, according to CrowdStrike.
- What
- The group exploited VMware flaw CVE-2026-41709 to reduce audit-trail visibility.
- When
- CrowdStrike said exploitation occurred in 2025 and as late as early 2026.
- Where
- U.S. organizations, including legal-sector targets.
- Why
- The flaw enabled certain administrator operations to go unlogged, reducing visibility into activity.
This story does not have two clearly opposing sides.
Broadcom disclosed CVE-2026-41709 alongside other VMware security defects.
CrowdStrike said Warp Panda used the flaw in several intrusions.
CrowdStrike said Warp Panda exploited CVE-2026-41709 as a zero-day.
CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog.
Deadline for federal agencies to apply fixes, according to CISA’s recommendation.
- Vulnerability
- CVE-2026-41709
- Severity
- Low; CVSS score 2.7
- Threat actor
- Warp Panda, also tracked as Armory Castle, Clay Typhoon and VerdantBamboo
- Affected software
- VMware ESXi and related VMware products
- Federal patch deadline
- November 11, 2026
2 sources
What people are saying
Warp Panda represents a sustained and strategically focused China-nexus cyber espionage threat to U.S. entities across multiple sectors, including the legal sector.
The legal sector's concentration of client communications, merger and acquisition materials, active litigation strategy, and cross-client access makes it a high-value collection target for a state-directed adversary seeking intelligence with downstream operational utility.
actively circumvents detection by bypassing audit logging, harvesting cloud session tokens, and registering rogue multi-factor authentication (MFA) devices.