Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CISA has flagged a newly exploited VMware ESXi vulnerability, CVE-2026-41709, which was initially classified as a minor insufficient-logging weakness allowing an administrator to carry out certain actions without leaving a trace. The bug was fixed on July 29 together with several more severe ESXi, vCenter, Workstation and Fusion issues, and is resolved in VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389 and later builds. CISA has placed it in its Known Exploited Vulnerabilities catalog and given federal agencies a two-week deadline to remediate. CrowdStrike separately disclosed that the China-linked group Warp Panda used this logging flaw as a zero-day throughout 2025 and into early 2026 to erase traces of its activity after breaching VMware vCenter via internet-facing edge devices, deploying tools like BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit against US targets including law firms. Two other critical bugs from the same July 29 disclosure, CVE-2026-59309 and CVE-2026-59310, have also reportedly been abused by China-nexus actors, with Quirso linking exploitation of the latter to roughly 360 compromised vCenter servers and later ransomware deployment.