WARP PANDA used VMware ESXi zero-day against US law firms
Original title: Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks
CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.
CrowdStrike attributes intrusions against US law firms, continuing into early 2026, to China-nexus group WARP PANDA, which deployed malware in VMware vCenter and exploited CVE-2026-41709 to bypass ESXi command logging. The report does not give affected versions, a CVSS score or a fix, and does not claim the flaw alone enabled initial access or remote code execution. The same assessment describes other China-nexus activity against legal organizations and says extortion groups named 455 legal organizations on leak sites.
Unconfirmed: CrowdStrike does not establish that CVE-2026-41709 provided initial access or remote code execution, and no patch details are given.
- CrowdStrike’s window is September 1, 2025, through August 31, 2026.
- Earlier vCenter activity used BRICKSTORM, JSP web shells and ESXi implants.
- TITAN PANDA exploited a hardcoded IIS machine key in Intapp Time Server in April 2026.
- MURKY PANDA’s ORB28 password spraying hit more than 340 organizations.
- Financially motivated actors accounted for 82% of observed legal-sector activity.
Impact: Bypass of ESXi command logging after compromise
| Product | Affected |
|---|---|
| VMware ESXi | — |
- CVEs
- CVE-2026-41709
- ATT&CK
- T1070.002 Clear Linux or Mac System LogsT1070.006 TimestompT1505.003 Web ShellT1110.003 Password Spraying
- Vendors
- VMware
- Threat actors
- WARP PANDATITAN PANDAMURKY PANDAOVERCAST PANDA
- Malware
- BRICKSTORM
- Organizations
- CrowdStrike
- Countries
- ChinaUnited StatesUnited Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
From the original article
2 min read at gbhackers.com
Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U. S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.