China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

What happened

Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor (the person or group behind an attack) known as Warp Panda in attacks targeting the U.S. China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility  Ravie Lakshmanan  Oct 29, 2026 Vulnerability / Cyber Espionage The U.S. Broadcom is a semiconductor company based in Irvine.

Attacks mounted by Warp Panda involve the exploitation of internet-facing edge devices to obtain initial access, after which the threat actor pivots to VMware vCenter environments to deploy custom malware like BRICKSTORM and SharpStorm to maintain persistent access without attracting attention.

The vulnerability in question is CVE-2026-41709 (CVSS score: 2.7), an insufficient logging vulnerability that could permit a malicious actor with admin access to perform certain operations without being logged. Warp Panda "exploits internet-facing edge devices using zero-day vulnerabilities and custom malware to maintain covert, persistent access," it said in the report shared with The Hacker News, adding the adversary "actively circumvents detection by bypassing audit logging, harvesting cloud session tokens, and registering rogue multi-factor authentication (MFA) devices."

The threat actor, also tracked as Armory Castle (formerly UNC5221), Clay Typhoon, and VerdantBamboo, has a storied history of weaponizing zero-day vulnerabilities in Citrix NetScaler and Ivanti Connect Secure devices.