CISA Lists ESXi Logging Flaw China-Linked Warp Panda Used as Zero-Day

A VMware ESXi flaw that lets an administrator act on a host without leaving a log entry is now on the US government’s list of exploited vulnerabilities. CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalogue on 28 October, giving federal agencies until 11 November to fix it. The same day, CrowdStrike said a China-linked group it tracks as Warp Panda had used the bug as a zero-day, before any patch existed, against US organisations including law firms.

Broadcom, which owns VMware, fixed the flaw in a security advisory first published on 29 July. Hosts that have not had those updates should be patched now.

Builds that fix the flaw

Broadcom lists these fixed versions for CVE-2026-41709. There is no workaround.

• ESX 9.1 (VMware Cloud Foundation and vSphere Foundation): ESXi-9.1.0.0-25370933
• ESX 9.0 (VMware Cloud Foundation and vSphere Foundation): ESXi-9.0.2.0100-25595025
• ESX 8.0: ESXi80U3j-25429389
• VMware Cloud Foundation 5.x: upgrade to 5.2.4, with the async patching guide in KB88287
• VMware Telco Cloud Platform 5.0 and 5.1: see KB449886

ESX 7.0 is not listed as affected by this flaw. The same advisory also fixed four other bugs, including two critical vCenter flaws rated 9.8. One of those, CVE-2026-59310, a path traversal bug, has been on CISA’s exploited list since 18 August, with use in ransomware campaigns marked as known.

A low score with high value to spies

On paper, the bug looks minor. Broadcom rated it low, with a CVSS score of 2.7, because the attacker already needs administrator access. “A malicious administrator could exploit this issue to perform certain operations without them being logged,” the advisory says. It credits Ian Barton of CrowdStrike with reporting it.

For an intruder who has already taken over a virtualisation server, though, that is exactly the point. CrowdStrike’s legal sector threat report, released on 28 October, says Warp Panda “exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day” in several intrusions at US-based entities, “as late as early 2026”. The group deployed several forms of malware in victims’ VMware vCenter environments, the report adds.

Who Warp Panda is

CrowdStrike first described Warp Panda in December 2025 as a China-nexus group, active since at least 2022, that targets VMware vCenter and ESXi. It said the group uses a backdoor called BRICKSTORM and two implants, Junction and GuestConduit, often gets in through internet-facing edge devices, and clears logs and alters file timestamps to hide. CrowdStrike assessed that its work was “likely motivated by intelligence-collection requirements” aligned with Chinese state interests. That attribution is CrowdStrike’s; no government has named the group in connection with this flaw.

CrowdStrike has not said how many organisations were hit through the ESXi bug. CISA lists ransomware use of it as unknown.

Why hiding from logs matters

TSN’s analysis: this case shows the gap between a severity score and real-world risk. A 2.7 rating will sit near the bottom of most patch queues, yet CISA’s listing tells defenders an espionage group found it worth using. For a group that aims to stay inside networks for years, the ability to work on a hypervisor without leaving a trace is a long-term asset, not a one-off trick.

It also fits a wider pattern. Lumen says China-linked Volt Typhoon relied on at least four zero-days, and ransomware crews have moved from VPN gateways to the hypervisor layer once inside. CISA has also been giving agencies short deadlines, such as three days for the Fragnesia Linux kernel flaw. Earlier this month CrowdStrike also tied an open-source AI tool to attacks on Korean banks.

What audit and compliance teams should check

For law firms, banks and other regulated firms, the issue goes beyond patching. If attackers had admin access to ESXi before a host was updated, the host’s logs may be incomplete for that period. Audit and compliance teams that rely on those logs to prove who did what, for example for data protection or record-keeping duties, should note the gap and treat older ESXi logs with care. Security teams should confirm each host’s build number, review who held ESXi admin accounts, and check vCenter for unregistered virtual machines and other signs of the tools CrowdStrike described.

Sources

• CISA: Known Exploited Vulnerabilities catalogue, CVE-2026-41709 added 28 October 2026
• Broadcom: VMSA-2026-0006, VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (29 July 2026, updated 19 August 2026)
• CrowdStrike: CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies (28 October 2026)
• CrowdStrike: Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary (4 December 2025)
• NIST NVD: CVE-2026-41709

Related stories

• Lumen Says Volt Typhoon Exploited at Least Four Zero-Days for Access
• Ransomware Gangs Exploit Months-Old Palo Alto GlobalProtect Flaw, Unit 42 Says
• CISA Gives Agencies Three Days to Patch Linux Kernel Flaw Fragnesia