Chinese-linked WARP PANDA Uses VMware ESXi Zero-Day CVE-2026-41709 to Evade Logging
CrowdStrike disclosed on 28 October 2026 that the China-associated group WARP PANDA exploited CVE-2026-41709, a zero-day logging flaw in VMware ESXi, during espionage operations against U.S. legal sector organizations. The vulnerability, rated 2.7 on CVSS 3.1, allows a malicious administrator to perform certain operations without generating log entries, thereby hindering incident reconstruction by defenders. Broadcom, which maintains the product, credited researcher Ian Barton for the report and released fixes in specific ESXi builds rather than simple version numbers. The flaw was added the same day to CISA’s catalog of exploited vulnerabilities, with a remediation deadline of 11 November 2026. CrowdStrike observed the activity spanning September 2025 to August 2026 and linked it to deployment of BRICKSTORM and SharpStorm malware inside victim vCenter environments, along with theft of cloud session tokens and unauthorized multi-factor authentication records. No alternative mitigations have been published, underscoring the risk of deprioritizing low-severity issues that primarily affect audit integrity.
BoletimSecOct 30, 2026Translated from Portuguese