China-Linked Warp Panda Exploits VMware ESX Zero-Day Vulnerability

• •CVE-2026-41709 is an insufficient logging vulnerability exploited by Warp Panda.
• •The vulnerability allows malicious actions to go unlogged, complicating incident response.
• •CISA added the CVE to its KEV catalog on October 28, 2026, indicating active exploitation.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41709, an insufficient logging vulnerability in Broadcom VMware ESX, to its Known Exploited Vulnerabilities catalog on October 28, 2026. The vulnerability, exploited by the China-linked threat actor Warp Panda, allows malicious administrators to perform actions without logging them, potentially obscuring malicious activities. CrowdStrike's report indicates that Warp Panda has been using this zero-day since early 2026, targeting the U.S. legal sector. The flaw affects various VMware products, including VMware Cloud Foundation and ESXi, and has a CVSS score of 2.7. Organizations with internet-facing edge devices and shared administrative access are particularly at risk. The threat actor is known for exploiting zero-day vulnerabilities and maintaining covert access through custom malware. CISA's advisory emphasizes the urgency of applying patches to mitigate risks associated with this vulnerability.