CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog after CrowdStrike reported that the China-nexus threat actor Warp Panda weaponized the flaw in VMware ESX to reduce audit trail visibility. The vulnerability, rated CVSS 2.7, is an insufficient logging issue that could let an admin-level attacker perform operations without being logged. Broadcom disclosed that the issue was fixed in VMware Cloud Foundation SXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, VMware ESX ESXi80U3j-25429389, VMware Cloud Foundation 5.2.4, and VMware Telco Cloud Platform ESXi80U3j-25429389. Warp Panda, also known as Armory Castle, Clay Typhoon and VerdantBamboo, has used the zero-day to bypass audit logging, harvest cloud session tokens and register rogue MFA devices, targeting the U.S. legal sector and other entities. Federal Civilian Executive Branch agencies are recommended to apply the fixes by November 11, 2026. 1
Published by The Hacker News · On GETSECURE.ai ·
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
⚡ High Priority
Why This Matters
If you use VMware ESX, you should verify that your environment runs one of the patched versions listed by Broadcom and apply the update before the November 11 deadline.
Title card · GETSECURE.ai
References
- The Hacker News. (2026, October 29). China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility. The Hacker News. https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html
Original Source
The Hacker News
Read original →