CISA added a VMware ESX vulnerability to its Known Exploited Vulnerabilities catalog on Wednesday, following a CrowdStrike report that a China-linked group called Warp Panda used it as a zero-day against the U.S. legal sector.

The flaw, CVE-2026-41709, is an insufficient logging issue that Broadcom says could let an admin perform some operations without being logged. It carries a CVSS score of 2.7, a low rating for a bug described as actively exploited. Broadcom's July 2026 advisory lists fixed versions across Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform.

CrowdStrike's 2026 Legal Threat Landscape Report says Warp Panda exploited the flaw in early 2026 to reduce audit trail visibility. The group, also tracked as Armory Castle, Clay Typhoon, and VerdantBamboo, has a history of targeting edge devices with zero-days, including in Citrix NetScaler and Ivanti Connect Secure. Mandiant separately attributed BeyondTrust Remote Support exploitation to the crew.

Per CrowdStrike, the actor uses edge-device access to reach VMware vCenter, deploys malware including BRICKSTORM and SharpStorm, harvests cloud session tokens, and in at least one case registered a new MFA device on a compromised account. CrowdStrike called the legal sector a high-value target given client communications, deal materials, and litigation strategy. Federal civilian agencies are advised to patch by November 11, 2026.

Source: The Hackers News