CISA lists VMware ESX logging flaw exploited by Warp Panda
Original title: China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.
CISA added Broadcom VMware ESX flaw CVE-2026-41709, CVSS 2.7, to the KEV catalog after CrowdStrike said China-nexus Warp Panda used it as a zero-day in early 2026 against the U.S. legal sector. An administrator can perform certain operations without logging. Broadcom fixed it in July 2026 builds for Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. CrowdStrike also describes edge-device access, BRICKSTORM and SharpStorm, stolen cloud tokens, and rogue MFA devices.
Unconfirmed: CrowdStrike’s legal-sector zero-day claim is from its report shared with The Hacker News.
- Fixed builds include ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389.
- VMware Cloud Foundation 5.2.4 is also listed as addressed.
- Warp Panda is also tracked as Armory Castle, Clay Typhoon, and VerdantBamboo.
- FCEB agencies are told to apply fixes by November 11, 2026.
- Mandiant linked the crew to BeyondTrust CVE-2026-102764 earlier this month.
Impact: Admin operations on ESX without audit logging
| Product | Affected | Fixed in |
|---|---|---|
| Broadcom VMware ESX | — | ESXi80U3j-25429389 |
| Broadcom VMware Cloud Foundation | — | SXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and 5.2.4 |
| Broadcom VMware vSphere Foundation | — | SXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025 |
| Broadcom VMware Telco Cloud Platform | — | ESXi80U3j-25429389 |
- 1.Apply Broadcom’s fixed ESX and Cloud Foundation builds.
- 2.Federal civilian agencies should patch CVE-2026-41709 by November 11, 2026.
- CVEs
- CVE-2026-41709
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1562 Impair DefensesT1550.004 Web Session CookieT1098 Account Manipulation
- Vendors
- Broadcom
- Threat actors
- Warp PandaArmory CastleClay TyphoonVerdantBamboo
- Malware
- BRICKSTORMSharpStorm
- Organizations
- CISACrowdStrikeMandiant
- Countries
- ChinaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
From the original article
2 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.