CISA Adds VMware ESX Logging Flaw to KEV After Warp Panda Zero-Day Report
Summary
CISA added VMware ESX flaw CVE-2026-41709 to its KEV catalog after CrowdStrike reported Warp Panda exploited it as a zero-day to bypass audit logging. The flaw requires admin access; FCEB agencies are urged to patch by Nov. 11, 2026.
Key points
- CISA added VMware ESX CVE-2026-41709 to its Known Exploited Vulnerabilities catalog.
- CrowdStrike reported that China-linked threat actor Warp Panda exploited the flaw as a zero-day in early 2026 against U.S. legal-sector targets.
- The insufficient-logging flaw could let an attacker with admin access perform certain operations without those actions being logged.
- CrowdStrike says Warp Panda also bypasses audit logging, harvests cloud session tokens, and registers rogue MFA devices to maintain access.
- The article says Warp Panda has used VMware vCenter to deploy custom malware including BRICKSTORM and SharpStorm.
- FCEB agencies are recommended to apply fixes by November 11, 2026; the article does not specify the fixed versions.
Article Details
- Vulnerability Types
- Insufficient logging
- Improper origin validation
- Severity
- CVE-2026-41709: CVSS 2.7; CVE-2026-102764: CVSS 9.3
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1098.005 · Device RegistrationIn at least one reported intrusion, Warp Panda registered a new MFA device on a compromised account to maintain access.T1190 · Exploit Public-Facing ApplicationWarp Panda exploited zero-day vulnerabilities in internet-facing edge devices to obtain initial access.T1528 · Steal Application Access TokenWarp Panda harvested cloud session tokens to access Microsoft 365 environments.T1550.001 · Application Access TokenWarp Panda used harvested cloud session tokens to access Microsoft 365 environments.T1562 · Impair DefensesWarp Panda exploited CVE-2026-41709 to bypass audit logging and reduce audit-trail visibility.
CVE
CVE-2026-102764to the zero-day exploitation of a critical improper origin validation in BeyondTrust Remote Support (CVE-2026-102764, CVSS score: 9.3) to deliver malware families like SAWFLY and BARECLAW.CVE-2026-41709The vulnerability in question is CVE-2026-41709 (CVSS score: 2.7), an insufficient logging vulnerability that could permit a malicious actor with admin access to perform certain operations without being logged.
Threat Actors
ARMORY CASTLECrowdStrike reported that this China-nexus threat actor exploited CVE-2026-41709 as a zero-day in early 2026 and used malware and audit-logging bypasses to maintain covert access.Clay TyphoonThe article identifies Clay Typhoon as another tracking name for Warp Panda, which CrowdStrike reported exploited CVE-2026-41709 as a zero-day.VerdantBambooThe article identifies VerdantBamboo as another tracking name for Warp Panda, which CrowdStrike reported exploited CVE-2026-41709 as a zero-day.
Malware
BARECLAWRemote Support (CVE-2026-102764, CVSS score: 9.3) to deliver malware families like SAWFLY and BARECLAW.BRICKSTORMafter which the threat actor pivots to VMware vCenter environments to deploy custom malware like BRICKSTORM and SharpStorm to maintain persistent access without attracting attention.SAWFLYin BeyondTrust Remote Support (CVE-2026-102764, CVSS score: 9.3) to deliver malware families like SAWFLY and BARECLAW.SharpStormthe threat actor pivots to VMware vCenter environments to deploy custom malware like BRICKSTORM and SharpStorm to maintain persistent access without attracting attention.
Vendors
Products
BeyondTrust Remote Supportthe hacking crew to the zero-day exploitation of a critical improper origin validation in BeyondTrust Remote Support (CVE-2026-102764, CVSS score: 9.3) to deliver malware families like SAWFLY and BARECLAW.Citrix NetScalerThe threat actor, also tracked as Armory Castle (formerly UNC5221), Clay Typhoon, and VerdantBamboo, has a storied history of weaponizing zero-day vulnerabilities in Citrix NetScaler and Ivanti Connect Secure devices.Ivanti Connect SecureThe threat actor, also tracked as Armory Castle (formerly UNC5221), Clay Typhoon, and VerdantBamboo, has a storied history of weaponizing zero-day vulnerabilities in Citrix NetScaler and Ivanti Connect Secure devices.Microsoft 365 Apps for Enterprisealso involved the targeting of cloud services with an aim to extract user session tokens to access Microsoft 365 environments sans raising any credential-based alerts. In at least one case, Warp Panda is said toVMware ESXand Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had beenVMware vCenterof internet-facing edge devices to obtain initial access, after which the threat actor pivots to VMware vCenter environments to deploy custom malware like BRICKSTORM and SharpStorm to maintain persistent access
Countries
ChinaExploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector.United StatesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it