Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
Product
VMware vCenter
- Mentions · 7d3
- Mentions · 30d3
- All mentions11
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
11 articles · newest firstWARP PANDA used VMware ESXi zero-day against US law firms
CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.
76
Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
78
CVE-2026-33824: CISA Flags Windows IKE RCE as Exploited
CISA added four actively exploited vulnerabilities to its KEV catalog, headlined by CVE-2026-33824, a Windows IKE Service Extensions remote code execution flaw.
78
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.
78
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.
86
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.
80
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk
QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.
78
vCenter Flaw Exploited Just Five Days After Disclosure
Attackers began exploiting critical vCenter flaw CVE-2026-59310 five days after Broadcom's disclosure, putting enterprise VMware deployments at risk.
78
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.
88
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
80
Related CVEs
by mentions- CVE-2026-593103%9.8Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
- CVE-2026-41709<1%2.7Insufficient logging in VMware ESX for admin operations
- CVE-2026-593098%9.8VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service
- CVE-2026-3382477%9.8Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension
- CVE-2026-654002%9.8Authentication Bypass in Apple macOS Screen Sharing
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-76418<1%8.6Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
- CVE-2026-47876<1%9.3VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter
Appears with
- VMwarevendor · 10
- Broadcomvendor · 9
- CISAorganization · 5
- Applevendor · 3
- BrickStormmalware · 3
- VMware ESXiproduct · 3
- CrowdStrikeorganization · 3
- Microsoftvendor · 3
- Warp Pandathreat actor · 3
- SharePoint Serverproduct · 2
- Ciscovendor · 2
- VMware Workstationproduct · 2
- SharpStormmalware · 2
- VMware ESXproduct · 2
- SentinelOnevendor · 2
- Broadcomorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.