What happened

• CVE-2026-41709 is an insufficient-logging flaw in VMware ESXi rated CVSS 2.7. It could let an actor with admin access perform certain operations without being logged [S1].
• CrowdStrike attributes zero-day exploitation in early 2026 to the China-nexus actor Warp Panda [S1].
• The reported activity is tied to attacks on the US legal sector [S1].
• The actor is also reported to bypass audit logging, harvest cloud session tokens and register rogue MFA devices [S1].
• CISA added the CVE to the KEV catalog. Broadcom's July 2026 advisory lists fixed builds [S1].

Timeline

Detect

ESXi / vCenter log silence per host · ESXi host syslog (hostd, vpxa, vmkernel, shell) and vCenter logs forwarded to Splunk

index=* ("hostd" OR "vpxa" OR "vmkernel" OR "shell") | bin _time span=15m | stats count by host, _time | streamstats current=f last(_time) as prev_time by host | eval gap_min=round((_time-prev_time)/60) | where gap_min>30 | table host prev_time _time gap_min

A hit means: A hypervisor or vCenter stopped forwarding logs for more than 30 minutes. This is consistent with audit-log bypass, but also with outages. The flaw suppresses logging of certain operations, so no gap does not mean no exploitation.

ESXi syslog / audit configuration changes · ESXi host syslog and vCenter events

index=* ("Syslog.global.logHost" OR "Syslog.global.logDir" OR "system syslog" OR "auditrecord") | stats count min(_time) as first max(_time) as last values(user) as user by host | sort - last

A hit means: Someone changed where or whether the host logs. This is a generic hunt for audit-log tampering. The source does not publish the specific commands Warp Panda used.

Verify

• Match each log gap against change tickets, maintenance windows, host reboots and syslog collector outages before treating it as suspicious.
• Check whether gaps affect one host or all hosts at once. A gap across all hosts at the same time points to a collector or network problem.
• Confirm the host build against the fixed versions. Gaps on fixed builds point to other causes.
• Benign look-alikes: planned patching, vMotion or maintenance mode, syslog forwarder restarts, and authorised admin syslog reconfiguration.

Scope

Affected

• VMware ESXi / vSphere / Cloud Foundation builds prior to the fixed versions in Broadcom's July 2026 advisory [S1]

Only if

• Attacker already holds admin access on the affected ESXi component [S1]

Not affected if

None stated by the sources.

Fixed in: ESXi-9.1.0.0-25370933 (VMware Cloud Foundation and vSphere Foundation); ESXi-9.0.2.0100-25595025; ESXi80U3j-25429389 (VMware ESX and Telco Cloud Platform); VMware Cloud Foundation 5.2.4 [S1]

Enumerate

• All ESXi hosts and their build numbers, compared with the fixed versions
• Accounts with ESXi or vCenter admin rights, and their recent logons
• Hosts whose syslog forwarding is missing or incomplete
• Cloud identities with recent session-token anomalies or newly registered MFA devices (reported actor behaviour) [S1]

Contain

• Preserve current ESXi and vCenter logs and collector data before patching or rebooting.
• Restrict ESXi and vCenter admin access to management networks and named accounts.
• Rotate ESXi and vCenter admin credentials if any log gap or unexplained admin activity is found. Rotation invalidates existing sessions and cannot be undone.
• Revoke suspect cloud session tokens and remove unrecognised MFA devices after recording them as evidence [S1].

Eradicate

• Apply Broadcom's fixed builds to remove the logging flaw [S1].
• Remove any unauthorised admin accounts, rogue MFA registrations or syslog configuration changes found during the hunt. The source does not describe specific ESXi persistence.

Recover

• Before restoring trust, validate that each patched host forwards hostd, vpxa, vmkernel and shell logs end to end.
• Afterwards, monitor for new log gaps, admin logons from unusual sources and new MFA device registrations.

Re-enter the loop when

• CrowdStrike, CISA or Broadcom publish IoCs or command-level behaviours for Warp Panda.
• Broadcom revises the affected or fixed versions.
• Reporting extends the targeting beyond the US legal sector, for example to finance.
• A hunt finds a log gap or rogue MFA device that you cannot explain.

Debrief

• Record ESXi build inventory, patch dates and the result of the log-gap review.
• Gap: the source gives no IoCs, commands or detection logic.
• Gap: initial access to ESXi admin is not described.
• Gap: the KEV addition date and the exact Broadcom advisory ID are not given in the source.

Detection coverage — checked automatically

Checked automatically 2026-11-10 22:22Z from public sources: 9 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-41709 — China-nexus Warp Panda exploited VMware ESXi logging flaw CVE-2026-41709 to reduce audit visibility, targeting US legal. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-41709

product:"VMware ESXi"

host.services: (software.product = "VMware ESXi")

http.title:"VMware ESXi"

http.html:"VMware ESXi"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (VMware ESXi) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: http.component:"VMware ESXi".

Banner spellings: a model read 3 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 22:22Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Is the 'SXi-9.1.0.0-25370933' build string in the exposure data a typo for ESXi-9.1.0.0-25370933? Verify against Broadcom's advisory.
• What is the primary CrowdStrike report, and what IoCs does it contain?
• When was the CVE added to KEV, and what is the due date?
• The card sets P2 versus the pipeline's P1 because exploitation requires prior admin access. The analyst should confirm.

Sources

• [S1] https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html · The Hacker News

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.