China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a security flaw in Broadcom's VMware ESX in its Known Exploited Vulnerabilities (KEV) catalog after CrowdStrike revealed the vulnerability was weaponized by a China-linked threat actor named Warp Panda. The vulnerability, CVE-2026-41709, has a CVSS score of 2.7 and allows a malicious actor with admin access to carry out operations without being logged.

Broadcom warned that the issue was remedied in later versions. This comes following a report by CrowdStrike stating that Warp Panda exploited CVE-2026-41709 as a zero-day vulnerability in early 2026 to reduce audit trail visibility. The threat actor uses internet-facing edge devices, zero-day vulnerabilities, and custom malware to maintain covert, persistent access while bypassing audit logging, harvesting cloud session tokens, and registering rogue multi-factor authentication (MFA) devices.

The adversary, also known as Armory Castle, has a history of weaponizing zero-day vulnerabilities in Citrix NetScaler and Ivanti Connect Secure devices. Attacks by Warp Panda typically start by exploiting internet-facing edge devices to gain initial access, then pivot to VMware vCenter environments to deploy custom malware to maintain persistent access without drawing attention.

Some intrusions also involve targeting cloud services to extract user session tokens and access Microsoft 365 environments without raising credential-based alerts. In some cases, Warp Panda registered a new MFA device on a compromised account to ensure persistent access even if the password is changed. The legal sector, with its concentration of client communications, merger and acquisition materials, active litigation strategy, and cross-client access, is a prime target for this China-nexus cyber espionage threat. FCEB agencies are advised to apply the fixes by November 11, 2026 to mitigate the risk.