China-Linked Hackers Use VMware ESX Zero-Day to Hide Audit Trail

Patch VMware ESX now if you have not. CVE-2026-41709 is a low-scored logging flaw, but a China-nexus group called Warp Panda used it as a zero-day to hide admin activity. CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog.

What happened

CISA added the flaw to KEV, as The Hacker News reported, after CrowdStrike revealed it had been weaponized against the U.S. legal sector. CrowdStrike's 2026 Legal Threat Landscape Report says Warp Panda exploited CVE-2026-41709 as a zero-day in early 2026. The goal was to reduce audit trail visibility.

The bug is a case of insufficient logging. A malicious actor with admin access can perform certain operations on an ESX host without those operations being logged.

Warp Panda is also tracked as Armory Castle (formerly UNC5221), Clay Typhoon, and VerdantBamboo. It has a history of weaponizing zero-days in Citrix NetScaler and Ivanti Connect Secure devices.

How the attackers get in and stay in

This flaw is a cover-your-tracks tool, not a way in. The attacker needs admin access first.

CrowdStrike describes the usual path:

1. Exploit an internet-facing edge device to get initial access.

2. Pivot to VMware vCenter environments.

3. Deploy custom malware such as BRICKSTORM and SharpStorm for persistent access.

4. In some intrusions, steal cloud session tokens to reach Microsoft 365 without triggering credential-based alerts.

In at least one case, the group registered a new MFA device on a compromised account. That keeps access alive even after a password change.

Fixed versions

Broadcom addressed the issue in an advisory released in July 2026. These are the fixed builds:

Check Broadcom's July 2026 advisory for the full list of affected versions before you plan your rollout.

How serious it is

The CVSS score is 2.7, which is low. Do not let that number set your priority.

The flaw does not give anyone access. It removes your evidence once someone has it. A host with this bug can hide the very actions you would hunt for after a breach.

It is also actively exploited. Federal Civilian Executive Branch (FCEB) agencies are told to apply fixes by November 11, 2026. Private teams can use the same date as a sensible target.

For a similar pattern of quiet access, see our write-up of the Volt Typhoon Silent Train framework. Our CVE-2026-41709 explainer covers the flaw on its own.

What to do now

1. Check your build numbers

Run this on each host over SSH or the ESXi shell. Compare the build number with the table above.

esxcli system version get

Example: a host on the 8.0 line that reports a build below 25429389 is not at ESXi80U3j-25429389. Put it in your patch queue.

2. Patch

Apply the fixed build for your product from the table. Use Broadcom's advisory for the exact download. Patch vCenter-managed clusters in your normal maintenance order, starting with hosts reachable from less trusted networks.

3. Send logs off the host

Logs stored only on a host can be missing or altered. Forward them to a remote syslog or SIEM so you have a second copy.

esxcli system syslog config get
esxcli system syslog config set --loghost='udp://siem.example.com:514'
esxcli system syslog reload
esxcli network firewall ruleset set --ruleset-id=syslog --enabled=true

Replace siem.example.com with your collector. Use TCP or TLS if your collector supports it.

4. Look for gaps and rogue MFA devices

A host with a quiet stretch in its logs while vCenter shows activity deserves a closer look. Compare the two sources for the same time window.

In Microsoft Entra ID, search for new MFA registrations. This query works in Log Analytics if you export audit logs there:

AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName in ("User registered security info", "Admin registered security info")
| project TimeGenerated, OperationName, InitiatedBy, TargetResources

Review any registration you cannot match to a real user request. Revoke the sessions and remove the device.

5. Reduce the attack surface

• Keep ESX management interfaces and vCenter off the internet.

• Patch edge devices first, since Warp Panda starts there.

• Limit who holds admin rights on hosts and vCenter.

• Review accounts that can register MFA devices.

What learners can take from this

This case shows why logging is a control, not a chore. A flaw scored 2.7 still mattered because it blinded defenders. You also see the full attack chain: edge device, virtualization layer, then cloud identity.

If you are building skills here, the cybersecurity certification category lists exams that cover logging, identity and incident response. Our voucher code is emailed within 12 hours of payment and also shown in your account.

Sources

• China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility (The Hacker News)