CISA added a VMware ESX logging vulnerability to its Known Exploited Vulnerabilities catalog on October 28, 2026, citing evidence of active exploitation. The move follows findings by CrowdStrike, reported by The Hacker News, that China-nexus threat actor Warp Panda used CVE-2026-41709 as a zero-day in early 2026 during attacks targeting the U.S. legal sector.
The vulnerability requires administrator access and allows certain operations to go unlogged. Its reported CVSS score of 2.7 describes its severity; CISA’s catalog addition establishes that exploitation has occurred. In the attacks described by CrowdStrike, the flaw served to reduce audit visibility after attackers had gained access.
From edge access to reduced visibility
According to CrowdStrike’s 2026 Legal Threat Landscape Report, as described by The Hacker News, Warp Panda compromises internet-facing edge devices and then moves into VMware vCenter environments. It deploys custom malware, including BRICKSTORM and SharpStorm, to maintain persistent access while avoiding detection.
CrowdStrike said the group exploited CVE-2026-41709 to obscure its activity. That logging weakness is distinct from the vulnerabilities used to obtain initial access: an attacker must already have administrator privileges to use it.
Some intrusions also targeted cloud services with the aim of extracting user session tokens to access Microsoft 365 without triggering credential-based alerts. In at least one case, CrowdStrike said, the attackers registered a new multifactor authentication device on a compromised account, providing a way to retain access even after a password change.
CrowdStrike characterized Warp Panda as a sustained cyberespionage threat across multiple U.S. sectors. It identified legal firms’ client communications, merger and acquisition materials, litigation strategy and access across clients as intelligence targets.
Reported fixes and federal remediation scope
The Hacker News reported that Broadcom addressed the logging vulnerability in a July 2026 advisory, listing these fixed releases by product:
- VMware Cloud Foundation:
SXi-9.1.0.0-25370933andESXi-9.0.2.0100-25595025; the report also separately lists VMware Cloud Foundation5.2.4. - VMware vSphere Foundation:
SXi-9.1.0.0-25370933andESXi-9.0.2.0100-25595025. - VMware ESX:
ESXi80U3j-25429389. - VMware Telco Cloud Platform:
ESXi80U3j-25429389.
The Hacker News gives November 11, 2026, as the date for Federal Civilian Executive Branch agencies to apply fixes. That federal remediation scope does not extend to every organization. CISA’s alert says its binding operational directive applies only to those agencies, while encouraging all organizations to prioritize remediation of known exploited vulnerabilities through risk-based vulnerability management.
