Skip to content
OriginalSign in

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Warp Panda used VMware flaw to hide attacks on US legal sector

Part of the CVE-2026-41709 story · since 29 Jul

Developinglatest 17 hours ago7 articles5 outlets
29 Jul · SecurityWeek first15 Sep1 Oct17 OctNowThis article5th of 7
  • Wed 29 Jul, 11:51 UTC. SecurityWeek, first report. Broadcom Warns of VMware Flaws Allowing Host Code Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 14:07 UTC. Security Affairs, its first report on the story. Broadcom patches critical VMware flaws, including admin VM escape. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 20:00 UTC. CISA, its first report on the story. CISA flags actively exploited VMware ESX logging flaw in KEV. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 00:00 UTC. SecurityOnline, its first report on the story. CISA flags Linux and VMware flaws as actively exploited. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 07:30 UTC. The Hacker News, its first report on the story. Warp Panda used VMware flaw to hide attacks on US legal sector. Cites a CVE in CISA KEV. This article, 5th of 7.
  • Thu 29 Oct, 08:30 UTC. SecurityWeek. Chinese Hackers Exploited VMware ESXi Logging Flaw as Zero Day. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 17:30 UTC. Security Affairs. CISA adds VMware and Linux kernel flaws to exploited list. Cites a CVE in CISA KEV.

The Hacker News reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw to its Known Exploited Vulnerabilities (KEV) catalog after CrowdStrike linked a China-nexus actor, Warp Panda, to weaponising the flaw in attacks targeting the U.S. legal sector. The vulnerability is CVE-2026-41709, described as an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. CISA’s action followed CrowdStrike’s findings and an advisory from Broadcom in July 2026 confirming fixes in several VMware product versions.

The article lists the specific impacted versions that were addressed in Broadcom’s advisory, including VMware Cloud Foundation SXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025, VMware vSphere Foundation SXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025, VMware ESX ESXi80U3j-25429389, VMware Cloud Foundation 5.2.4, and VMware Telco Cloud Platform ESXi80U3j-25429389.

It notes Warp Panda had exploited CVE-2026-41709 as a zero-day earlier in 2026 to reduce audit trail visibility, with CrowdStrike describing the actor as actively bypassing audit logging, harvesting cloud session tokens, and registering rogue MFA devices to maintain persistence.

The piece attributes Warp Panda to a broader China-nexus espionage threat and quotes CrowdStrike about the sector-targeting focus, while recommending that Federal Civilian Executive Branch agencies apply the fixes by 11 November 2026 in light of active exploitation. The report also situates Warp Panda among prior campaigns against Citrix NetScaler and Ivanti Connect Secure devices.

How the story developed

All 7 articles
Developinglatest 17 hours ago7 articles5 outlets

7 articles from 5 outlets since 29 Jul. Picked up again on 28 Oct after 13 weeks quiet. This was the 5th report, 92 days after the first.

Now29 Jul3028 Oct29First reportSecurityWeek · 29 Jul, 11:51This article5th of 7 · day 92
  • Wed 29 Jul, 11:51 UTC. SecurityWeek, first report. Broadcom Warns of VMware Flaws Allowing Host Code Execution. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 14:07 UTC. Security Affairs, its first report on the story. Broadcom patches critical VMware flaws, including admin VM escape. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 20:00 UTC. CISA, its first report on the story. CISA flags actively exploited VMware ESX logging flaw in KEV. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 00:00 UTC. SecurityOnline, its first report on the story. CISA flags Linux and VMware flaws as actively exploited. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 07:30 UTC. The Hacker News, its first report on the story. Warp Panda used VMware flaw to hide attacks on US legal sector. Cites a CVE in CISA KEV. This article, 5th of 7.
  • Thu 29 Oct, 08:30 UTC. SecurityWeek. Chinese Hackers Exploited VMware ESXi Logging Flaw as Zero Day. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 17:30 UTC. Security Affairs. CISA adds VMware and Linux kernel flaws to exploited list. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Wed 29 JulDay 02
    1. Broadcom Warns of VMware Flaws Allowing Host Code Execution11:51 · SecurityWeek · First report · Exploited CVE · Known exploited CVE
    2. Broadcom patches critical VMware flaws, including admin VM escape14:07 · Security Affairs · Known exploited CVE

  2. Quiet for 13 weeks

    Wed 28 OctDay 911
    1. CISA flags actively exploited VMware ESX logging flaw in KEV20:00 · CISA · official · CISA alert · Picked up again · Known exploited CVE
  3. Thu 29 OctDay 924
    1. CISA flags Linux and VMware flaws as actively exploited00:00 · SecurityOnline · Known exploited CVE
    2. Warp Panda used VMware flaw to hide attacks on US legal sector07:30 · The Hacker News · Known exploited CVE · This article, 5th of 7
    3. Chinese Hackers Exploited VMware ESXi Logging Flaw as Zero Day08:30 · SecurityWeek · Known exploited CVE
    4. CISA adds VMware and Linux kernel flaws to exploited list17:30 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in