CISA Flags Exploited VMware ESXi Logging Flaw; CrowdStrike Links Zero-Day Use to Warp Panda
Summary
CISA added VMware ESXi flaw CVE-2026-41709 to its KEV catalog and urged federal agencies to patch it. CrowdStrike reports China-linked Warp Panda used the flaw as a zero-day to reduce audit visibility in US organization intrusions.
Key points
- CVE-2026-41709 is an insufficient-logging flaw that lets logged-in administrators perform certain operations without those actions being recorded.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and directed federal agencies to patch within two weeks; CISA did not share details of observed exploitation.
- CrowdStrike reported that China-linked actor Warp Panda exploited the flaw as a zero-day in intrusions at US organizations, including law firms.
- CrowdStrike said the actor used the flaw in several attacks, as late as early 2026, to reduce audit-trail visibility.
- Patches are included in VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, and newer releases.
- The article also reports in-the-wild targeting of CVE-2026-59309 and CVE-2026-59310; Quirso said CVE-2026-59310 was used to compromise about 360 internet-accessible vCenter servers.
Article Details
- Vulnerability Types
- Insufficient logging
- Severity
- Low
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-41709Tracked as CVE-2026-41709, the exploited flaw is described as a low-severity insufficient logging issue.CVE-2026-59309security defects described in Broadcom’s July 29 advisories have been targeted in the wild, namely CVE-2026-59309 (a critical-severity authentication bypass) and CVE-2026-59310 (a critical directory traversal issueCVE-2026-59310have been targeted in the wild, namely CVE-2026-59309 (a critical-severity authentication bypass) and CVE-2026-59310 (a critical directory traversal issue leading to arbitrary code execution).
Threat Actors
Malware
BRICKSTORMthrough internet-facing edge devices and pivots to VMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.DualGaugeand pivots to VMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.GuestConduitVMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.SharpStormedge devices and pivots to VMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.TetanusStormedge devices and pivots to VMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.
Vendors
BroadcomAt least two other security defects described in Broadcom’s July 29 advisories have been targeted in the wild, namely CVE-2026-59309 (a critical-severity authentication bypass) and CVE-2026-59310 (a critical directoryVMwareThe US cybersecurity agency CISA on Wednesday warned that hackers have been exploiting another VMware ESXi vulnerability in attacks.
Products
ESXiThe US cybersecurity agency CISA on Wednesday warned that hackers have been exploiting another VMware ESXi vulnerability in attacks.VMware vCenter ServerThe security defect was disclosed on July 29 alongside three critical and one high-severity bug in VMware vCenter, ESXi, Workstation, and Fusion.
Countries
ChinaCISA did not provide details on the observed exploitation, but CrowdStrike reported on Wednesday that the China-nexus threat actor Warp Panda had exploited CVE-2026-41709 as a zero-day in intrusions at US organizations,United Statesthat the China-nexus threat actor Warp Panda had exploited CVE-2026-41709 as a zero-day in intrusions at US organizations, including law firms.