A zero-day vulnerability in VMware ESX was exploited by a China-nexus threat actor known as Warp Panda, targeting the U.S. legal sector to reduce audit trail visibility.
The vulnerability or weakness
The exploit targeted CVE-2026-41709, an insufficient logging vulnerability that could allow a malicious actor with admin access to perform operations without being logged, with a CVSS score of 2.7. It was added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-102764 | 9.3 | CRITICAL | Yes, added 2026-10-16 | 2026-10-19 |
| CVE-2026-41709 | 2.7 | LOW | Yes, added 2026-10-28 | 2026-11-11 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls (2026-10-28)
- Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks (2026-10-22)
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack (2026-10-22)
- Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion (2026-10-21)
Business impact
Organizations could face significant operational risks, as the vulnerability could be used to maintain covert, persistent access without leaving a trace, potentially leading to data breaches or unauthorized access.
Industries affected
The U.S. legal sector was specifically targeted, but the vulnerability could affect other industries using VMware ESX.
Users affected
Users of VMware ESX, especially in the legal sector, are at risk of having their systems exploited, compromising their data security and operational integrity.
