Warp Panda used VMware ESXi flaw to hide operations
CISA added VMware ESXi’s CVE-2026-41709 to its Known Exploited Vulnerabilities catalog after CrowdStrike reported Warp Panda using it as a zero-day in U.S. intrusions, including at law firms, as late as early 2026.
The flaw lets someone who already has administrator access perform certain actions without ESXi recording them. That makes the audit trail incomplete: a quiet log cannot establish that those actions did not happen, and patching cannot restore missing historical entries.
CrowdStrike says Warp Panda often gains access through internet-facing edge devices, then pivots into VMware vCenter; its reported activity also includes stealing cloud session tokens and enrolling rogue multifactor authentication devices. For law firms, an investigation based only on ESXi logs from the affected period could miss activity after that initial access.