CERT24Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as a Zero-DayLoading data…
CERT24Threat Observatory
Period

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as a Zero-Day

The US cybersecurity agency CISA warned that attackers have exploited a VMware ESXi vulnerability in attacks. CVE-2026-41709 is described as a low-severity insufficient-logging flaw that allows attackers logged in as administrators to perform certain operations without being logged. CrowdStrike reported that the China-nexus threat actor Warp Panda exploited it as a zero-day against US organizations, including law firms. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.

← Back to intelligence

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as a Zero-Day

The US cybersecurity agency CISA warned that attackers have exploited a VMware ESXi vulnerability in attacks. CVE-2026-41709 is described as a low-severity insufficient-logging flaw that allows attackers logged in as administrators to perform certain operations without being logged. CrowdStrike reported that the China-nexus threat actor Warp Panda exploited it as a zero-day against US organizations, including law firms. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.