WARP PANDA used VMware ESXi zero-day against US law firms
CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.
76
Vendor
VMware
- Mentions · 7d4
- Mentions · 30d14
- All mentions33
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
33 articles · newest firstWarp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
78
Canada updates VMware advisory after two CVEs enter CISA KEV
CVE-2026-41709 joined the KEV catalog on October 28; CVE-2026-59310 was added on August 18.
78
VLC and VMware binaries side-load malware targeting Brazil and Portugal
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
62
Two unfixed Linux KSMBD flaws allow remote code execution, CVSS 9.0
One flaw needs no authentication on port 445; neither has a CVE or a confirmed mainline fix.
78
Cyber Partisans hid Vasilek in VMware Tools for two years
Vasilek 1.5.8 ran from a fake VMware Tools service and could log keys, capture screens, and move the cursor.
74
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Topgolf saved over $11.3M after leaving VMware
Topgolf reports more than $11.3 million saved after migrating from VMware to VergeOS.
28
VMware is pushing so many patches, it thinks users need new tools to manage the flood
Broadcom will sell HyperArmor to virtually patch VCF, lock configurations, and add MFA.
42
PoC Exploit Released for Critical VMware Vulnerability Enabling Guest-to-Host Attacks
Public PoC for CVE-2026-59346 crashes VMware Workstation and Fusion through a guest-to-host integer overflow.
66
PoC Released for Critical VMware VMXNET3 Flaw Enabling Guest-to-Host Code Execution
Public PoC for VMware CVE-2026-59346 crashes the host VMX process but does not prove code execution.
66
Broadcom VMware security advisory (AV26-1008)
Canada's Cyber Centre urges updates for VMware Workstation and Fusion overflow flaws.
46
Hackers Hide Vasilek Backdoor Inside VMware Tools to Target Medical Organizations
Partisan Zmiy hid the Vasilek backdoor in VMware Tools during a two-year medical-organization intrusion.
74
Police Target KillSec Ransomware Group with Arrests and Seizures
European police seized KillSec infrastructure and arrested suspects, including a 16-year-old alleged ringleader.
75
ESXi Exploitation in the Wild
Huntress stopped an intrusion that used a VMware ESXi VM-escape toolkit after SonicWall VPN access.
81
ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories
Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.
46
ZDI-26-647: VMware Workstation VMXNET3 TSO Segmentation Integer Overflow Local Privilege Escalation Vulnerability
ZDI disclosed an integer overflow in VMware Workstation's VMXNET3 TSO code (CVE-2026-59346) enabling local privilege escalation.
30
CVE-2026-33824: CISA Flags Windows IKE RCE as Exploited
CISA added four actively exploited vulnerabilities to its KEV catalog, headlined by CVE-2026-33824, a Windows IKE Service Extensions remote code execution flaw.
78
Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS
New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.
45
Leaving VMware just got harder after Broadcom pulled VDDK downloads
Broadcom removed public downloads of VMware's VDDK, breaking or complicating migration tools like Azure Migrate, Nutanix Move, and virtv2v.
8
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom patched two VMware Workstation and Fusion flaws, including critical integer overflow CVE-2026-59346 (CVSS 9.3), letting guest admins execute host code; no exploitation seen.
60
Broadcom Patches Critical VMware Workstation and Fusion VM
Broadcom patched critical VMware Workstation and Fusion VM-escape flaws CVE-2026-59346 (CVSS 9.3) and CVE-2026-59347 (CVSS 8.1); update to 26H1u1.
65
Vali Cyber ZeroLock 5 brings MFA to the hypervisor command line
Vali Cyber released ZeroLock 5 adding CLI-MFA to protect VMware ESX and Linux hypervisors from insider threats and stolen credentials.
27
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.
78
Tufin expands Unified Control Plane with AI intelligence and multi-vendor automation
Tufin's TOS 5.3 adds AI-powered Segmentation Intelligence and multi-vendor automation for AWS, Palo Alto, VMware NSX-T, and Cisco Meraki to its Unified Control Plane.
20
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.
86
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.
80
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
78
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk
QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.
78
CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
82
vCenter Flaw Exploited Just Five Days After Disclosure
Attackers began exploiting critical vCenter flaw CVE-2026-59310 five days after Broadcom's disclosure, putting enterprise VMware deployments at risk.
78
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.
88
Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
Broadcom patches three critical VMware flaws, including vCenter auth bypass CVE-2026-59309 and an ESX VM escape, urging immediate updates.
80
Related CVEs
by mentions- CVE-2026-593103%9.8Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
- CVE-2026-593098%9.8VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service
- CVE-2026-59346<1%9.3VMXNET3 integer overflow in VMware Workstation and Fusion
- CVE-2026-654002%9.8Authentication Bypass in Apple macOS Screen Sharing
- CVE-2026-41709<1%2.7Insufficient logging in VMware ESX for admin operations
- CVE-2026-3382477%9.8Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- HGFS stack buffer overflow in VMware Workstation and Fusion
- CVE-2026-47876<1%9.3VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter
- CVE-2025-412362%9.3VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter
Appears with
- Broadcomvendor · 16
- VMware vCenterproduct · 10
- Microsoftvendor · 8
- VMware Workstationproduct · 8
- VMware Fusionproduct · 7
- VMware ESXiproduct · 5
- CISAorganization · 5
- vCenterproduct · 4
- Broadcomorganization · 4
- Applevendor · 4
- Quirsoorganization · 4
- VMwareorganization · 3
- Unit 42organization · 3
- Windowsproduct · 3
- Zero Day Initiativeorganization · 3
- Palo Alto Networksvendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.