Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

What it is

CVE-2026-41709 is a low-severity insufficient-logging flaw in VMware ESXi. An attacker logged in as an administrator can perform certain operations without those operations being logged. Broadcom disclosed it on July 29, 2026, together with three critical and one high-severity bug across vCenter, ESXi, Workstation and Fusion. CISA added it to the KEV catalog and set a two-week patch deadline for federal agencies.

How it works

CrowdStrike reported that the China-nexus actor Warp Panda used the flaw as a zero-day to significantly reduce audit trail visibility. The page gives no technical detail on which operations escape logging.

Per CrowdStrike, Warp Panda typically enters through internet-facing edge devices and then pivots to VMware vCenter. In 2025 intrusions it deployed BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit. It used CVE-2026-41709 in several of those attacks, as late as early 2026. Targets included US organizations, among them law firms.

Preconditions / Affected

The attacker needs administrator access to ESXi, so the flaw hides activity rather than gaining entry. Its severity rating understates its use in intrusions. The same July 29 advisories cover two other flaws exploited in the wild:

• CVE-2026-59309: critical authentication bypass in vCenter.
• CVE-2026-59310: critical directory traversal leading to arbitrary code execution.

In mid-August 2026, Quirso reported an APT exploiting CVE-2026-59310 against about 360 web-accessible vCenter servers, deploying an SSH reverse shell. Quirso later attributed this to a China-linked actor. It said CVE-2026-59309 was also exploited, likely before CVE-2026-59310 and possibly by a different actor. Mass targeting of CVE-2026-59310 was flagged in early September 2026.

What to do

Update ESXi to one of these builds or newer:

• ESXi-9.1.0.0-25370933
• ESXi-9.0.2.0100-25595025
• ESXi80U3j-25429389

Also apply the July 29 vCenter patches, since two of its critical bugs are exploited. The page does not list fixed vCenter builds.

Because Warp Panda used the logging flaw to thin out audit trails, gaps in ESXi logs on unpatched hosts are not evidence of a clean host. The page offers no detection queries or indicators. Hunting would have to rely on the malware names above and on vCenter exposure to the internet.

Caveats

CISA gave no details on the exploitation it observed. The Warp Panda link comes from CrowdStrike alone. Attribution of the vCenter exploitation rests on Quirso, which first called the actor an APT and only later said China-linked.