Chinese Hackers Exploited VMware ESXi Logging Flaw as Zero Day

CISA has warned that attackers have been exploiting VMware ESXi through a low-severity logging flaw tracked as CVE-2026-41709. The issue, described as insufficient logging, enables an attacker with administrative privileges to carry out certain operations without leaving audit logs. The vulnerability was disclosed on 29 July alongside other patches for VMware products including vCenter, ESXi, Workstation and Fusion.

VMware released patches in releases such as ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389, with newer editions also containing fixes.

CrowdStrike has reported that Warp Panda, a China-nexus threat group, exploited CVE-2026-41709 as a zero-day in intrusions at US organisations, including law firms. The group is described as gaining initial access via internet-facing edge devices and pivoting to VMware vCenter, where it deployed malware including BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions observed through 2025 and into early 2026.

In several campaigns, the actors used CVE-2026-41709 to significantly reduce audit-trail visibility. Security researchers note that other vulnerabilities disclosed by Broadcom on 29 July—CVE-2026-59309 (authentication bypass) and CVE-2026-59310 (directory traversal leading to code execution)—were also targeted in the wild, with mass exploitation tied to CVE-2026-59310.

Quirso has separately linked exploitation of CVE-2026-59310 to a China-linked actor and warned that CVE-2026-59309 was exploited earlier, potentially by a different group. CISA urged federal agencies to patch CVE-2026-41709 within two weeks.