Back Securityweek

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero

Securityweek •Ionut Arghire • October 29, 2026

The US cybersecurity agency CISA on Wednesday warned that hackers have been exploiting another VMware ESXi vulnerability in attacks.

Tracked as CVE-2026-41709, the exploited flaw is described as a low-severity insufficient logging issue. It allows attackers logged in as administrators to perform certain operations without being logged.

The security defect was disclosed on July 29 alongside three critical and one high-severity bug in VMware vCenter, ESXi, Workstation, and Fusion.

VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 and newer releases contain the relevant patches.

CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities ( KEV ) catalog, urging federal agencies to patch it within the two weeks.

CISA did not provide details on the observed exploitation, but CrowdStrike reported on Wednesday that the China-nexus threat actor Warp Panda had exploited CVE-2026-41709 as a zero-day in intrusions at US organizations, including law firms.

According to CrowdStrike, Warp Panda typically gains initial access through internet-facing edge devices and pivots to VMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.

In several of those attacks, and as late as early 2026, the group used CVE-2026-41709 to significantly reduce audit trail visibility.

At least two other security defects described in Broadcom’s July 29 advisories have been targeted in the wild, namely CVE-2026-59309 (a critical-severity authentication bypass) and CVE-2026-59310 (a critical directory traversal issue leading to arbitrary code execution).

In mid-August, cybersecurity company Quirso said an APT had been exploiting CVE-2026-59310 to compromise approximately 360 web-accessible VMware vCenter servers and deploy an SSH reverse shell.

Later, Quirso attributed the activity to a China-linked threat actor and warned that CVE-2026-59309 had been exploited as well, likely before CVE-2026-59310, potentially by a different threat actor.

Mass targeting of CVE-2026-59310 was flagged in early September.

Related: Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Related: TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

Related: China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Related: Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chinese Hackers Exploit VMware ESXi Logging Flaw as Zero-Day The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that a low-severity VMware ESXi vulnerability, CVE-2026-41709, is being by the China-linked threat actor Warp Panda. This insufficient logging flaw allows attackers with administrator access to perform operations without being logged, significantly reducing audit trail visibility. The vulnerability was disclosed on July 30, 2026, and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it promptly. CrowdStrike reported that Warp Panda has targeted U.S. Organizations, particularly in the legal sector, deploying various malware types such as BrickStorm and SharpStorm. The exploitation of this flaw is part of a broader campaign that also involves other critical vulnerabilities in VMware products. Organizations using affected VMware versions are advised to apply patches immediately to mitigate risks. 4 sources 80

Extracted Entities

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

CVEs (3)

CWE Weaknesses (2)

Malware (5)

MITRE ATT&CK (2)

Platforms (4)

Ransomware Groups (2)