CVE-2026-41709
Known exploited · CISA KEV
CISA federal remediation date Nov 11
Vulnerabilities · 5h ago
CISA added VMware ESXi’s CVE-2026-41709 to its Known Exploited Vulnerabilities catalog after CrowdStrike reported Warp Panda using it as a zero-day in U.S. intrusions, including at law firms, as late as early 2026.
The flaw lets someone who already has administrator access perform certain actions without ESXi recording them. That makes the audit trail incomplete: a quiet log cannot establish that those actions did not happen, and patching cannot restore missing historical entries.
CrowdStrike says Warp Panda often gains access through internet-facing edge devices, then pivots into VMware vCenter; its reported activity also includes stealing cloud session tokens and enrolling rogue multifactor authentication devices. For law firms, an investigation based only on ESXi logs from the affected period could miss activity after that initial access.
Known exploited · CISA KEV
CISA federal remediation date Nov 11
2 sources covering this story
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged.
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
CISA added CVE-2026-41709 to its KEV catalog after Warp Panda exploited the VMware ESX logging flaw in attacks targeting the U.S.
Part of the PlainSec briefing for 2026-10-29