WARP PANDA exploited VMware ESX logging bypass as a zero-day, CrowdStrike says

CISA added a VMware ESX flaw, CVE-2026-41709, to its KEV catalog on Oct 28. Broadcom says it lets a malicious administrator perform certain operations without them being logged. CrowdStrike said on Oct 28 that WARP PANDA, a China-nexus group it tracks, exploited the flaw as a zero-day in several intrusions at US organizations, as late as early 2026. Broadcom fixed it on Jul 29 in ESX builds for VMware Cloud Foundation, vSphere Foundation, ESX 8.0 and Telco Cloud Platform.

Broadcom rates the flaw low, with a CVSS score of 2.7, and says exploiting it takes a malicious administrator. It lists no workaround. Broadcom credits Ian Barton of CrowdStrike with reporting the flaw, and fixed it in VMSA-2026-0006, the same advisory that fixed two vCenter flaws it rated critical. CISA asks federal agencies to apply the fix by Nov 11.

CrowdStrike’s post on its 2026 report on threats to the legal sector says WARP PANDA’s intrusions at US organizations included targets in the legal sector. The group deployed several forms of malware in victims’ VMware vCenter environments, CrowdStrike says, and in several of those cases it exploited the ESX logging bypass. The post doesn’t say how the group got in or name the malware.

Because the flaw lets an administrator act without the actions being logged, logs from an unpatched ESX host may not show everything an administrator account did there.