CERT24Chinese Hackers Quietly Used a Low-Severity ESXi Logging Flaw as a Zero-DayLoading data…
CERT24Threat Observatory
Period

Chinese Hackers Quietly Used a Low-Severity ESXi Logging Flaw as a Zero-Day

CISA warned that attackers have used the VMware ESXi vulnerability CVE-2026-41709 in attacks. The issue is a low-severity insufficient-logging flaw that allows attackers logged in as administrators to perform certain operations without those operations being logged. According to CrowdStrike, the China-nexus threat actor Warp Panda used the flaw as a zero-day in intrusions targeting US organizations, including law firms.

← Back to intelligence

Chinese Hackers Quietly Used a Low-Severity ESXi Logging Flaw as a Zero-Day

CISA warned that attackers have used the VMware ESXi vulnerability CVE-2026-41709 in attacks. The issue is a low-severity insufficient-logging flaw that allows attackers logged in as administrators to perform certain operations without those operations being logged. According to CrowdStrike, the China-nexus threat actor Warp Panda used the flaw as a zero-day in intrusions targeting US organizations, including law firms.