Chinese-linked hackers exploited a VMware ESXi zero-day to conceal activity on compromised servers during espionage operations against U.S. organizations, including law firms. CrowdStrike identified the group as WARP PANDA and reported that it used the flaw, tracked as CVE-2026-41709, in multiple intrusions, with exploitation continuing into early 2026.
These findings are included in CrowdStrike’s 2026 Legal Threat Landscape Report, published on October 28, 2026. Researchers observed WARP PANDA deploying several types of malware inside victims’ VMware vCenter environments and using the ESXi command logging bypass as a zero-day in some attacks.
The case demonstrates how a low-rated security issue can help attackers remain hidden after gaining control. Rather than providing remote code execution or elevating privileges on its own, this vulnerability lets an attacker who already has administrator access carry out certain actions without generating the expected log entries.
VMware ESXi logging bypass works
Broadcom’s advisory describes CVE-2026-41709 as an insufficient logging vulnerability in VMware ESX. It is assigned a CVSS score of 2.7 and a Low severity rating. Broadcom credits CrowdStrike researcher Ian Barton with reporting the issue.
The requirement for prior access is important: this is not an unauthenticated remote code execution flaw and does not itself grant administrator rights. Its value to attackers is post-compromise—allowing a malicious administrator to perform certain operations without those actions being recorded. Broadcom’s advisory does not publish the full list of affected operations.
The absence of expected log evidence can complicate investigations. If defenders rely on the affected logs to reconstruct an intrusion, some attacker activities may be missing. The advisory does not state that the flaw deletes existing records or disables all monitoring sources, which is an important limitation when evaluating impact.
Cyber Security News previously covered this issue alongside reports of a critical VMware authentication bypass and other vulnerabilities that appeared in the same advisory; those other flaws have different access requirements and effects. CrowdStrike’s public summary does not indicate WARP PANDA combined those additional issues in the same intrusions.
CrowdStrike’s reporting period ran from September 1, 2025, through August 31, 2026. Law firms are attractive targets because they hold privileged communications, merger details, intellectual property, government-related material, and financial records—data valuable for intelligence collection and theft.
WARP PANDA was one of four prominent China-linked groups described in the report. In April 2026, TITAN PANDA exploited a hardcoded IIS machine key vulnerability in Intapp Time Server, a timekeeping and billing product used almost exclusively by law firms.
MURKY PANDA’s ORB28 password-spraying campaign affected more than 340 mainly U.S. organizations across several sectors, with legal entities hit particularly hard. At one law firm, researchers logged nearly 500 failed login attempts against as many accounts, originating from about 300 IP addresses over 30 days. CrowdStrike noted this campaign fell slightly outside its reporting period.
OVERCAST PANDA separately targeted executives at a U.K. law firm in September and October 2025. The report presents these as distinct operations rather than a single coordinated campaign.
Patches released
Broadcom lists fixed ESXi builds for the logging flaw as ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389. VMware Cloud Foundation 5.x users should follow the 5.2.4 update guidance, and affected Telco Cloud Platform deployments have separate instructions in KB449886. No workaround is provided in the advisory.
Administrators should match their exact product and release to Broadcom’s response matrix rather than assume every VMware update addresses this issue. Cyber Security News has also reported on exploitation of the ESX logging vulnerability.
For patch prioritization, CISA’s Known Exploited Vulnerabilities catalog can be used alongside vendor guidance and observed threat activity. CrowdStrike’s documentation of zero-day use gives defenders a clear reason to assess exposure despite the flaw’s low numerical severity score.
AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?
