Search — “CVE-2026-41709”

CrowdStrike reported that China-nexus actor Warp Panda exploited CVE-2026-41709, an insufficient-logging flaw in Broadcom VMware ESXi (CVSS 2.7), as a zero-day in early 2026 to perform admin operations without being logged. Per the source, the actor targets internet-facing edge devices, pivots to vCenter to deploy BRICKSTORM and SharpStorm, and in some cases harvests cloud session tokens and registers rogue MFA devices. CISA added the CVE to KEV and FCEB agencies were told to patch by November 11, 2026. Hunters should look for gaps in ESXi/vCenter audit logging and for new MFA device registrations on M365 accounts.

CISA added CVE-2026-41709, a low-severity insufficient logging flaw in VMware ESXi, to its KEV catalog after CrowdStrike reported that the China-nexus actor Warp Panda exploited it as a zero-day in intrusions at US organizations, including law firms. Per CrowdStrike, Warp Panda typically gets initial access via internet-facing edge devices, pivots to vCenter, and used this CVE to significantly reduce audit trail visibility. Hunters should review ESXi and vCenter logging continuity and look for gaps in audit trails around administrator activity, since the flaw lets logged-in administrators act without being logged.

CrowdStrike attributes exploitation of CVE-2026-41709, a low-severity insufficient logging flaw in VMware ESXi, to the China-nexus actor Warp Panda, which used it as a zero-day in early 2026 to perform operations without audit logging. The reporting ties the activity to attacks on the US legal sector and says the actor also bypasses audit logging, harvests cloud session tokens, and registers rogue MFA devices. CISA added the CVE to the KEV catalog; defenders should review ESXi patch levels and look for gaps in ESXi and vCenter audit logs.