Chinese Hackers Exploited Low-Severity ESXi Logging Flaw as Zero-Day
The US cybersecurity agency CISA has added a low-severity VMware ESXi logging vulnerability to its Known Exploited Vulnerabilities catalog after revelations that a China-nexus threat group used it as a zero-day.
Radwan AbdulhadiEditor and technology writer
CISA Issues Warning Over Low-Severity ESXi Vulnerability
The US cybersecurity agency CISA warned that hackers have been actively exploiting a VMware ESXi vulnerability tracked as CVE-2026-41709. The security defect is characterized as a low-severity insufficient logging issue that permits attackers logged in with administrative privileges to carry out specific operations while evading standard audit logs.
Following the discovery, CISA added CVE-2026-41709 to its KEV catalog and instructed federal agencies to implement necessary patches within the next two weeks. While CISA did not disclose specific operational details regarding the observed attacks, security researchers have brought forward significant findings on how the flaw was leveraged in real-world campaigns.
Warp Panda Exploited Flaw as a Zero-Day
According to CrowdStrike, a China-nexus threat actor known as Warp Panda utilized CVE-2026-41709 as a zero-day during intrusions targeting various US organizations, including law firms. CrowdStrike reported that Warp Panda typically establishes initial access through internet-facing edge devices before pivoting to VMware vCenter.
Throughout 2025 and into early 2026, the group deployed multiple malware variants during these intrusions, including BrickStorm, TetanusStorm, SharpStorm, DualGauge, and GuestConduit. In several instances, Warp Panda relied on the ESXi logging defect to severely diminish audit trail visibility and cover its operational tracks.
Patching Information and Affected Releases
The underlying security defect was initially disclosed along with three critical-severity bugs and one high-severity bug affecting VMware vCenter, ESXi, Workstation, and Fusion. Broadcom and VMware released official updates to address the vulnerabilities.
Administrators running affected environments must upgrade to patched software versions. Official patches are included in VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389, as well as subsequent newer releases.
Broader Campaign Targets Multiple VMware Flaws
Beyond CVE-2026-41709, at least two other security flaws detailed in Broadcom's disclosures have faced active targeting in the wild. These include CVE-2026-59309, a critical-severity authentication bypass, and CVE-2026-59310, a critical directory traversal vulnerability that leads directly to arbitrary code execution.
In mid-August, cybersecurity firm Quirso reported that an advanced persistent threat group had exploited CVE-2026-59310 to compromise approximately 360 web-accessible VMware vCenter servers to deploy an SSH reverse shell. Quirso later attributed this activity to a China-linked threat actor and noted that CVE-2026-59309 was also targeted, potentially by a different threat actor prior to the mass exploitation wave observed in early September.
Sources
- SecurityWeekChinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Continue chronologically
Related stories
CISA Adds Node2Shell Flaw to KEV as Honeypots Log Attacks
CISA has added the Node2Shell Brotli vulnerability to its KEV catalog as security firms record initial exploitation attempts and major vendors issue patches.
Cisco Patches Actively Exploited SD-WAN Zero-Day Flaw
Cisco has released urgent patches for a critical zero-day authentication bypass vulnerability in Catalyst SD-WAN Manager actively exploited in the wild.
Palo Alto Networks Warns of Exploited PAN-OS RCE Zero-Day
Palo Alto Networks releases security updates addressing a high-severity PAN-OS remote code execution zero-day flaw actively targeted in attacks.
Citrix Patches NetScaler SAML Zero-Day Exploited in Attacks
Citrix has released emergency updates for a new NetScaler SAML denial-of-service zero-day vulnerability tracked as CVE-2026-88779.
