China-Linked Warp Panda Exploited VMware ESXi Zero-Day CVE-2026-41709 to Hide Inside Law Firm Networks

A China-nexus espionage group tracked as Warp Panda used a little-known VMware ESXi flaw as a zero-day to hide its actions inside the virtual infrastructure of U.S. organizations, including law firms, according to new research from CrowdStrike. The flaw, tracked as CVE-2026-41709, carries a CVSS score of just 2.7, but it let the attackers perform certain operations on ESXi hosts without them being logged.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026, and gave federal civilian agencies until November 11, 2026, to patch. The case shows how a bug rated “low” on paper can become a valuable tool for an advanced attacker who is already inside a network.

What CVE-2026-41709 does

Broadcom disclosed the flaw on July 29, 2026, in security advisory VMSA-2026-0006, alongside critical and high-severity bugs in VMware vCenter, ESX, Workstation and Fusion. Broadcom describes CVE-2026-41709 as an insufficient logging vulnerability in VMware ESX. According to the advisory, “a malicious administrator could exploit this issue to perform certain operations without them being logged.”

The flaw does not let an outsider break in, and it does not grant administrator rights on its own. An attacker first needs admin access to the ESXi host. That is why Broadcom rated it Low. Broadcom has not publicly listed which operations escape logging, and there is no workaround.

Broadcom credited Ian Barton of CrowdStrike with reporting the issue. At the time of the July disclosure, Broadcom did not say the flaw had been exploited.

Exploited as a zero-day into early 2026

The exploitation details come from the CrowdStrike 2026 Legal Threat Landscape Report, published on October 28, 2026. The report covers activity seen between September 1, 2025, and August 31, 2026.

CrowdStrike said Warp Panda carried out multiple intrusions at U.S.-based organizations, including targets in the legal sector, and deployed several forms of malware in victims’ VMware vCenter environments. “In several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day,” the company said.

Because the attackers already held administrative access in these cases, the flaw served a single purpose: making their actions harder to see. For defenders, that matters a great deal. Incident responders rely on ESXi and vCenter logs to rebuild what an intruder did. If key commands never reach the logs, an investigation can miss important steps in an attack, such as data staging or the creation of hidden virtual machines.

CrowdStrike has not said how many organizations were affected or named any victims.

Who is Warp Panda

CrowdStrike first publicly profiled Warp Panda in December 2025. The company describes it as a technically skilled, cloud-aware China-nexus adversary active since at least 2022. CrowdStrike assesses that its operations are likely driven by intelligence collection aligned with the strategic interests of the People’s Republic of China.

In that earlier research, CrowdStrike said it found Warp Panda inside VMware vCenter environments at U.S.-based legal, technology and manufacturing organizations during the summer of 2025. In one intrusion, the group first gained access in late 2023 and kept it for a long time.

The group’s known toolset includes:

• BRICKSTORM: a Golang backdoor that poses as legitimate vCenter processes. It tunnels traffic, manages files and hides command-and-control traffic using DNS-over-HTTPS, nested TLS channels and public cloud services.
• Junction: a Golang implant for ESXi hosts that poses as a legitimate VMware service. It can run commands, proxy traffic and talk to guest virtual machines through VM sockets.
• GuestConduit: a Golang tunneling implant that runs inside guest virtual machines and works with Junction to move traffic between guests and the hypervisor.
• JSP web shells on vCenter servers for persistence.

Industry reporting cited by CrowdStrike has noted that BRICKSTORM may also be used by other China-nexus groups. According to reports on the new research, CrowdStrike also lists TetanusStorm, SharpStorm and DualGauge among the malware Warp Panda used in intrusions throughout 2025. CrowdStrike has not publicly released technical analysis of those 3 tools.

How the attacks unfold

According to CrowdStrike, Warp Panda usually breaks in through internet-facing edge devices, often using zero-day flaws, and then moves into vCenter using valid credentials or vCenter vulnerabilities. Vulnerabilities the group has exploited in past operations include:

• CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Policy Secure
• CVE-2023-46747 in F5 BIG-IP
• CVE-2024-38812, CVE-2023-34048 and CVE-2021-22005 in VMware vCenter

Once inside, the group moves between hosts with SSH and the privileged vpxuser account that vCenter uses to manage ESXi hosts. CrowdStrike said Warp Panda clears logs, changes file timestamps and creates rogue virtual machines that are not registered in vCenter, then shuts them down after use.

The group has also cloned domain controller virtual machines, likely to steal the Active Directory database, and used an ESXi-compatible version of 7-Zip to pull data from snapshots of running guest machines. In cloud environments, CrowdStrike said Warp Panda stole Microsoft 365 session tokens to access OneDrive, SharePoint and Exchange data without triggering password alerts. In at least one case, it registered a new multifactor authentication (MFA) device on a compromised account so it could keep access even after a password change.

Against that background, a logging bypass on ESXi fits naturally into the group’s playbook. Warp Panda’s tradecraft already focuses on erasing evidence, and CVE-2026-41709 let it avoid creating some of that evidence in the first place.

Why law firms are in the crosshairs

The CrowdStrike report says cyber intrusions against the legal sector nearly doubled between 2023 and 2026. Law firms hold privileged client communications, merger and acquisition details, intellectual property, government matters and financial records. That mix makes them attractive to both criminals and state-backed spies.

Financially motivated attackers made up 82% of the activity CrowdStrike observed against legal organizations. Ransomware and extortion groups named 455 legal entities on their leak sites during the reporting period, a 39% increase from the previous year.

Warp Panda is one of 4 China-nexus groups that CrowdStrike called the top state-linked threats to the legal sector. The others are:

• Titan Panda: in April 2026, it carried out what CrowdStrike called the first observed targeting of legal-specific software by exploiting a hardcoded IIS machine key flaw in Intapp Time Server, a timekeeping and billing product used almost entirely by law firms.
• Murky Panda: its password spraying campaign hit more than 340 mostly U.S. organizations, with the legal sector the most affected. One law firm saw nearly 500 failed logins against as many accounts from about 300 IP addresses in 30 days.
• Overcast Panda: it targeted executive-level staff at a U.K. law firm in September and October 2025.

The report also flags financially motivated groups that impersonate IT staff to gain remote access. CrowdStrike said one such group hired a person to physically enter a U.S. law firm while posing as an IT employee in November 2025.

Part of a wider wave of China-linked edge and infrastructure attacks

The Warp Panda findings land during a busy stretch for China-linked operations against network and virtualization infrastructure. This week, researchers detailed how Volt Typhoon used its Silent Train relay network to carry out zero-day attacks, and attackers were seen chaining the PHP2Shell flaws with a Linux kernel bug to gain root on firewalls. China-linked hackers were also behind the breach of an FBI wiretap system reported earlier this year.

The common thread is a focus on systems that sit below normal endpoint security, such as hypervisors, VPNs and firewalls. These devices often lack endpoint detection tools and can give attackers long-term, quiet access to entire networks.

Patch and defense guidance

Broadcom lists the following fixed versions for CVE-2026-41709:

• VMware Cloud Foundation and vSphere Foundation 9.1.x: ESXi-9.1.0.0-25370933
• VMware Cloud Foundation and vSphere Foundation 9.0.x: ESXi-9.0.2.0100-25595025
• VMware ESX 8.0: ESXi80U3j-25429389
• VMware Cloud Foundation 5.x: 5.2.4 (see Broadcom KB88287)
• VMware Telco Cloud Platform 5.0.x and 5.1.x: see Broadcom KB449886

Because the flaw only helps attackers who already have admin access, patching should go hand in hand with hunting for signs of an existing compromise. Based on CrowdStrike’s guidance, organizations running vSphere should:

• Forward ESXi and vCenter syslog to an external platform so attackers cannot easily erase it.
• Watch for SSH logins to ESXi hosts, especially as root or vpxuser, and consider disabling SSH on ESXi.
• Look for virtual machines that are not registered in vCenter. CrowdStrike offers a free tool for this.
• Enable the ESXi execInstalledOnly setting and, on ESXi 8.0 or later, turn off shell access for the vpxuser account.
• Restrict outbound internet access from ESXi and vCenter and monitor unusual ports such as 8090.
• Require MFA through an identity provider for vCenter access and review cloud accounts for newly registered MFA devices.
• Patch internet-facing edge devices quickly, since they are Warp Panda’s usual way in.

Federal civilian agencies must apply the fixes by November 11, 2026, under CISA’s KEV requirements. Broadcom had not issued any public statement on the exploitation at time of publication beyond its July advisory.