China-Linked Hackers Used a VMware ESX Bug to Work Without Logs
CrowdStrike says China-nexus Warp Panda used CVE-2026-41709, a VMware ESX insufficient-logging flaw, as a zero-day against US law firms. CISA added it to KEV with a Nov. 11 deadline.
A VMware ESX bug that lets an administrator do certain things without leaving a log entry was used as a zero-day by a China-linked group earlier this year, CrowdStrike says, and CISA added it to its Known Exploited Vulnerabilities catalog on Oct. 28. CVE-2026-41709 scores only 2.7, but CrowdStrike’s 2026 Legal Threat Landscape Report says the group used it against US law firms to cover its tracks, The Hacker News reports.
For defenders
The bug: CVE-2026-41709 is an insufficient-logging flaw (CWE-778) in ESX. Someone who already has admin rights on the host can perform some operations without them being logged. Broadcom fixed it in its July advisory. The low score reflects that it needs high privileges and grants nothing new; its value to an attacker is hiding what happens after they’re in. No public exploit is reported. Federal agencies must patch by Nov. 11.
Fixed builds: ESXi80U3j-25429389 (ESX 8.0 and Telco Cloud Platform), ESXi-9.0.2.0100-25595025 and SXi-9.1.0.0-25370933 (Cloud Foundation and vSphere Foundation 9.x), and Cloud Foundation 5.2.4.
Who used it: CrowdStrike calls the group Warp Panda; THN says it’s the same cluster tracked as Armory Castle (formerly UNC5221), which Mandiant recently tied to BeyondTrust exploitation. Per CrowdStrike, it breaks in through internet-facing edge devices, pivots to vCenter to deploy the BRICKSTORM and SharpStorm backdoors, and has stolen Microsoft 365 session tokens, in one case registering a rogue MFA device. CrowdStrike says the group works to bypass audit logging, which is what this bug helps with.
Also added Oct. 28: CVE-2026-46300, a Linux kernel missing-initialization flaw. CISA’s alert gives no further detail.
Check: Because the bug hides activity, missing logs prove nothing. Look at vCenter and ESXi access from the network side, review who holds ESXi root and admin credentials, and confirm syslog is shipped off the host.
What it means for you
VMware ESX is the software many companies use to run their servers as virtual machines. This bug doesn’t let anyone in by itself; it helps someone who’s already in avoid being noticed. If your business has its own servers on VMware, the people who manage them need to install this update. If you don’t know what VMware is, this one is for your IT provider.
Do this now
- Update ESX hosts to the fixed builds in Broadcom’s advisory.
- Send ESXi and vCenter logs to a separate system the hosts can’t change.
- Keep vCenter and ESXi management off the internet and require MFA for admin access.
- Patch edge devices quickly; that’s how this group gets in first.
CVE at a glance
- CVSS
- 2.7 Low (v3.1)
- EPSS
- 0.8% chance of exploitation in the next 30 days (higher than 55.3% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 28, 2026
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.