China-Linked Hackers Exploit VMware ESX Logging Flaw to Conceal Activity

CISA added VMware ESX insufficient-logging vulnerability CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on October 28 after evidence of active exploitation. CrowdStrike reported that China-nexus threat actor Warp Panda exploited the flaw as a zero-day in early 2026 during intrusions targeting the U.S. legal sector. The vulnerability allows an attacker who already has administrative access to perform certain operations without generating expected system logs, reducing audit visibility and hindering investigations. Broadcom rates it low severity, with a CVSS v3.1 score of 2.7, but confirmed exploitation elevates its operational significance.

Broadcom released fixes in July through advisory VMSA-2026-0006, with fixed ESX builds and update guidance for affected VMware Cloud Foundation and Telco Cloud Platform deployments; no workaround is listed. Federal Civilian Executive Branch agencies must remediate by November 11, 2026, and other organizations should prioritize affected hosts despite the low severity score. Defenders should also investigate signs of Warp Panda’s broader activity, including BRICKSTORM and SharpStorm malware, stolen cloud session tokens, and unauthorized MFA registrations. Guyana’s National CIRT reiterated the patching guidance and noted that another flaw covered by the advisory, CVE-2026-59310, was already in CISA’s catalog. Ransomware use of CVE-2026-41709 remains unknown.