Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero

The US cybersecurity agency CISA on Wednesday warned that hackers have been exploiting another VMware ESXi vulnerability in attacks.

Tracked as CVE-2026-41709, the exploited flaw is described as a low-severity insufficient logging issue. It allows attackers logged in as administrators to perform certain operations without being logged.

The security defect was disclosed on July 29 alongside three critical and one high-severity bug in VMware vCenter, ESXi, Workstation, and Fusion.

VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 and newer releases contain the relevant patches.

CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities ( KEV ) catalog, urging federal agencies to patch it within the two weeks.

CISA did not provide details on the observed exploitation, but CrowdStrike reported on Wednesday that the China-nexus threat actor Warp Panda had exploited CVE-2026-41709 as a zero-day in intrusions at US organizations, including law firms.

According to CrowdStrike, Warp Panda typically gains initial access through internet-facing edge devices and pivots to VMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.

In several of those attacks, and as late as early 2026, the group used CVE-2026-41709 to significantly reduce audit trail visibility.

At least two other security defects described in Broadcom’s July 29 advisories have been targeted in the wild, namely CVE-2026-59309 (a critical-severity authentication bypass) and CVE-2026-59310 (a critical directory traversal issue leading to arbitrary code execution).

In mid-August, cybersecurity company Quirso said an APT had been exploiting CVE-2026-59310 to compromise approximately 360 web-accessible VMware vCenter servers and deploy an SSH reverse shell.

Later, Quirso attributed the activity to a China-linked threat actor and warned that CVE-2026-59309 had been exploited as well, likely before CVE-2026-59310, potentially by a different threat actor.

Mass targeting of CVE-2026-59310 was flagged in early September.

Related: Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Related: TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

Related: China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Related: Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.

Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload.

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.

TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs.

Hackers Start Probing Fresh Oracle EBS Vulnerability

CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution.

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.