Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day
Original title: Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.
CISA warned that attackers are exploiting CVE-2026-41709, a low-severity insufficient-logging flaw in VMware ESXi that lets an administrator perform some operations without those actions being logged. CrowdStrike says China-nexus Warp Panda used it as a zero-day against US organizations, including law firms, after reaching vCenter. Fixes are in named ESXi 9.1, 9.0, and 8.0 builds. CVE-2026-59309 and CVE-2026-59310 from the same July 29 advisories have also been exploited.
Unconfirmed: CrowdStrike attributes the zero-day use to Warp Panda; CISA gave no exploitation details.
- Fixed builds are ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 and newer.
- Warp Panda deployed BrickStorm, TetanusStorm, SharpStorm, DualGauge, and GuestConduit.
- Quirso said an APT used CVE-2026-59310 against about 360 internet-facing vCenter servers.
- CISA did not describe the exploitation it observed.
Impact: Admin ESXi operations run without being logged
| Product | Affected | Fixed in |
|---|---|---|
| VMware ESXi | — | ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 and newer |
- 1.Install the named ESXi builds that contain the logging fix.
- 2.US federal agencies should remediate CVE-2026-41709 within two weeks.
- Threat actors
- Warp Panda
- Organizations
- CISACrowdStrikeQuirso
- Countries
- ChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
| CVE-2026-59309 | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service | 9.8 | 8% | ||
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
From the original article
1 min read at securityweek.com
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.