VMware ESX Flaw Rated 2.7 Was a Zero-Day for Warp Panda

An authenticated administrator on a VMware ESX host can run certain operations without leaving a log entry, and CrowdStrike says the China-nexus group Warp Panda used that flaw, CVE-2026-41709, as a zero-day in intrusions at U.S. organisations. CISA added it to its Known Exploited Vulnerabilities catalog on Oct. 28, with a federal civilian deadline of Nov. 11.

Broadcom rated the flaw Low, CVSS 3.1 base score 2.7, with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. That means it is reachable over the network but needs high privileges, and it affects integrity only slightly. The score understates the risk. It measures what the bug does to the host, not what it does for an attacker who already holds administrative access and wants the record of their work to be empty.

Timeline from patch to KEV listing

Broadcom published advisory VMSA-2026-0006 on July 29, 2026 and revised it on Aug. 19. It covered five CVEs, and the two most severe were vCenter flaws scored 9.8. The Cloud Security Alliance's research note credits Ian Barton of CrowdStrike with the report on CVE-2026-41709.

• Early 2026: Warp Panda uses the flaw as a zero-day, according to CrowdStrike.
• July 29, 2026: Broadcom ships fixes and rates the issue Low.
• Oct. 28, 2026: CrowdStrike discloses the zero-day use and CISA lists the CVE.
• Nov. 11, 2026: deadline for Federal Civilian Executive Branch agencies.

The Hacker News attributes the zero-day claim to CrowdStrike's 2026 Legal Threat Landscape Report, which calls the U.S. legal sector a high-value collection target for a state-directed adversary. CISA's listing independently confirms exploitation; the attribution to Warp Panda and the victim profile rest on CrowdStrike alone. The start of exploitation is not public, so hosts may hold unlogged activity from before the July 29 patch.

Fixed builds, and the ESXi 7.0 gap

Branch	Fixed build per VMSA-2026-0006
VCF / vSphere Foundation 9.1.x	ESXi-9.1.0.0-25370933
VCF / vSphere Foundation 9.0.x	ESXi-9.0.2.0100-25595025
ESX 8.0	ESXi80U3j-25429389
VMware Cloud Foundation 5.x	5.2.4

The Cloud Security Alliance note says Broadcom's later guidance, VMSA-2026-0006.2, covered only the Critical-severity issues, and it lists no fix for CVE-2026-41709 on ESXi 7.0. Administrators on that branch should not assume one exists. No workaround is listed and the note found no public proof-of-concept.

What Warp Panda does with the blind spot

CrowdStrike describes Warp Panda as active since at least 2022 and specialised in vCenter and ESXi. The Cloud Security Alliance summary of that reporting says the group enters through internet-facing edge devices, including exploited Ivanti and F5 BIG-IP flaws, then moves to vCenter with valid credentials or older bugs such as CVE-2023-34048 and CVE-2024-38812. Its tooling includes the BRICKSTORM backdoor and an ESXi implant called Junction that impersonates a legitimate service on port 8090. Our report on the Ivanti Connect Secure KEV deadlines covers one of those entry points, and the Cisco ASA and FTD flaw is another edge device on the same catalog.

The Hacker News adds that Warp Panda harvests cloud session tokens to reach Microsoft 365 without triggering credential alerts and, in one case, registered a rogue MFA device so access survived a password reset.

What to do before Nov. 11

Patch every ESX host to the builds above regardless of the Low rating. Forward ESXi and vCenter logs off the host in real time to storage administrators cannot alter. Where compromise is suspected, the Cloud Security Alliance advises a check that does not rely on host logs: reconcile host and datastore VM inventories against vCenter for unregistered machines, and look for listeners on port 8090. Investigations closed on the strength of clean ESXi logs should be reopened.

The exact set of operations the flaw leaves unlogged has not been published, so there is no signature to search for. The next fixed date is the federal deadline of Nov. 11.