China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
Summary: CISA added CVE-2026-41709, an insufficient logging flaw in Broadcom VMware ESX with a CVSS score of 2.7, to its Known Exploited Vulnerabilities catalog after CrowdStrike reported that the China-nexus actor Warp Panda used it as a zero-day in early 2026 against the U.S. legal sector to reduce audit trail visibility. Broadcom addressed the issue in a July 2026 advisory, and FCEB agencies are directed to apply fixes by November 11, 2026.
Key Takeaway: Warp Panda pairs this logging gap with cloud session token harvesting and rogue MFA device registration, so a compromised account can retain persistent access even after its password is changed. The legal sector's concentration of client communications, merger and acquisition materials, and active litigation strategy is what CrowdStrike identifies as the target.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-102764CVE-2026-41709
- Related
- CISA Adds Two Known Exploited Vulnerabilities to Catalog Cyber Risks · Oct 28, 2026CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging Vulnerability Known Exploited Vulnerabilities · Oct 28, 2026CVE-2026-102764: Beyond Trust Remote Support Authentication Bypass by Spoofing Vulnerability Known Exploited Vulnerabilities · Oct 16, 2026