China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

CISA has added a Broadcom VMware ESX flaw, CVE-2026-41709, to its Known Exploited Vulnerabilities catalog after CrowdStrike disclosed that the China-linked group Warp Panda abused it as a zero-day against U.S. law firms. The bug, scored just 2.7 on CVSS, is an insufficient-logging issue that lets an attacker with administrative rights carry out actions on ESX without leaving audit trail entries, helping the intruders stay hidden inside vCenter environments while deploying malware such as BRICKSTORM and SharpStorm. Broadcom patched the flaw back in July across VMware Cloud Foundation, vSphere Foundation, VMware ESX, and Telco Cloud Platform builds including ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389. Warp Panda, also known as Armory Castle/UNC5221, Clay Typhoon and VerdantBamboo, has previously hit Citrix NetScaler, Ivanti Connect Secure and BeyondTrust Remote Support (CVE-2026-102764) with similar zero-day campaigns, and federal agencies now have until November 11, 2026 to apply the VMware fix.