CISA added CVE-2026-41709, a 2.7-rated VMware ESXi logging bug, to its KEV catalog on October 28, 2026, after CrowdStrike tied zero-day abuse to China-nexus group Warp Panda. The group used it to cut audit trail visibility at US organizations, including law firms.
Key Facts
- CISA told federal civilian agencies to patch CVE-2026-41709 by November 11, 2026, after confirming attackers had exploited the ESXi flaw.
- CrowdStrike said Warp Panda exploited the bug as a zero-day in early 2026, before Broadcom shipped a fix on July 29.
- The flaw lets an attacker who already holds ESXi admin access carry out certain operations without leaving a log entry.
- Broadcom’s July advisories now cover at least three bugs that attackers have exploited in the wild, including this one.
Warp Panda turned a 2.7-rated bug into cover
Broadcom classes CVE-2026-41709 as an insufficient logging issue. Its July advisory says a malicious actor with admin access could perform certain operations without being logged. That admin requirement explains the low score. For an intruder who already holds those rights, though, unlogged activity is exactly the goal.
CISA shared no details on the attacks when it added the flaw to its Known Exploited Vulnerabilities list. CrowdStrike filled in part of the picture the same day in its 2026 Legal Threat Landscape Report. The firm said Warp Panda exploited the bug as a zero-day. In several intrusions, as late as early 2026, the group used it to significantly reduce audit trail visibility.
According to CrowdStrike, Warp Panda typically breaks in through internet-facing edge devices and then pivots to VMware vCenter. Throughout 2025, it deployed BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit malware in those environments. The report says the actor “actively circumvents detection by bypassing audit logging.”
In select intrusions, the group went after cloud session tokens to reach Microsoft 365 without raising credential-based alerts. In at least one case, it registered a new MFA device on a compromised account, a foothold meant to survive a password reset.
CISA Flags Two Actively Exploited Vulnerabilities in VMware ESX and Linux Kernel 🤨 CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog, highlighting ongoing risks in widely used enterprise infrastructure. https://t.co/3rlWUHcbN0
— CyberOGZ (@cyberogz) October 29, 2026
The actor is also tracked as Armory Castle (formerly UNC5221), Clay Typhoon and VerdantBamboo. It has a long history of zero-day attacks on Citrix NetScaler and Ivanti Connect Secure devices. Earlier this month, Google-owned Mandiant tied it to zero-day exploitation of BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) to deliver SAWFLY and BARECLAW malware.
CrowdStrike described Warp Panda as a sustained, strategically focused state-linked espionage threat to US entities across several sectors. It singled out law firms for their client communications, merger and acquisition files, active litigation strategy and cross-client access.
Broadcom’s July batch keeps drawing attackers
The logging bug arrived in Broadcom’s July 29 Advisory. That batch also fixed three critical flaws and one high-severity flaw in vCenter, ESXi, Workstation and Fusion. Attackers have since targeted at least two of the critical ones. CVE-2026-59309 is an authentication bypass, while CVE-2026-59310 is a directory traversal issue that leads to arbitrary code execution.
Security firm Quirso said in mid-August that an advanced persistent threat (APT) group had been exploiting CVE-2026-59310. The attackers compromised approximately 360 web-accessible vCenter servers and deployed an SSH reverse shell. Quirso later attributed the campaign to a China-linked actor and said CVE-2026-59309 had been exploited too, likely earlier and potentially by a different group. Security vendor Gurucul flagged mass targeting of CVE-2026-59310 in early September.
Quirso’s attribution stops at a China-linked actor, so its vCenter campaign can’t yet be tied to Warp Panda. What the cases share is a target: the VMware management layer that controls an organization’s virtual machines.
Fixed builds for CVE-2026-41709, or any later release, include:
- ESXi-9.1.0.0-25370933 for VMware Cloud Foundation and vSphere Foundation.
- ESXi-9.0.2.0100-25595025 for VMware Cloud Foundation and vSphere Foundation.
- ESXi80U3j-25429389 for VMware ESX and Telco Cloud Platform.
- VMware Cloud Foundation 5.2.4.
Patching helps reduce risk going forward, but it can’t restore log entries that were never written. Teams that ran unpatched ESXi before Broadcom’s fix should treat host audit trails from that period as incomplete. Checking vCenter for the malware families CrowdStrike named, and reviewing Microsoft 365 for unexpected MFA device registrations, can surface activity the host logs missed.
Two questions stay open. How many organizations did Warp Panda hit with this bug, and which ESXi operations escape the log?
Federal civilian agencies have until November 11, 2026, to apply the fixes under CISA’s KEV listing. Warp Panda has now put both a 9.3 and a 2.7 to work. For everyone else running ESXi, the federal date is a sensible marker.
