Search — “CVE-2026-59310”

CISA added CVE-2026-41709, a low-severity insufficient logging flaw in VMware ESXi, to its KEV catalog after CrowdStrike reported that the China-nexus actor Warp Panda exploited it as a zero-day in intrusions at US organizations, including law firms. Per CrowdStrike, Warp Panda typically gets initial access via internet-facing edge devices, pivots to vCenter, and used this CVE to significantly reduce audit trail visibility. Hunters should review ESXi and vCenter logging continuity and look for gaps in audit trails around administrator activity, since the flaw lets logged-in administrators act without being logged.