Skip to content
securitytabs

Updated

Low-Rated VMware ESX Logging Flaw Used as Zero-Day by China-Linked Group

Hackers linked to China exploited a flaw in VMware ESX, software that runs virtual servers, to carry out actions without leaving normal log records. Organizations running ESX should check Broadcom's guidance, as a US government deadline for federal agencies is set.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

The Hacker News reports that CrowdStrike revealed a flaw in Broadcom VMware ESX had been used by a China-nexus threat actor known as Warp Panda in attacks targeting the US legal sector. The flaw is tracked as CVE-2026-41709 and is described as an insufficient logging vulnerability. [1]

SecurityWeek reports that the flaw allows attackers with administrative privileges to perform operations without being logged, and describes it as a low-severity flaw used as a zero-day (a flaw exploited before a fix existed). [2]

Severity and official listing

NVD gives the flaw a CVSS score of 2.7 under version 3.1 of the scale, which is low. CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on October 28, with a federal due date of November 11. CISA said the listing was based on evidence of active exploitation. [3][1]

CISA listed a Linux kernel flaw, CVE-2026-46300, in the same announcement. [3]

What is not yet known

The articles available do not say how many organizations were affected beyond the US legal sector targeting reported by The Hacker News, or give detection indicators for the activity. [1][2]

Timeline

  1. SecurityWeek reported the low-severity flaw had been used as a zero-day. [2]

  2. The Hacker News reported that CrowdStrike tied exploitation of the flaw to Warp Panda attacks on the US legal sector. [1]

  3. CISA added the VMware ESX logging flaw to its KEV catalogue. [3]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms rarely run ESX directly, but an IT provider or hosting company may. The flaw lets an attacker with administrative access avoid logging. [2]

What to do

  1. Ask your IT or hosting provider whether it uses VMware ESX and whether Broadcom's security advisory for this flaw has been applied. [1]
  2. Ask the provider who has administrative access to its ESX systems, since the flaw requires administrative privileges. [2]

Mid-size company

A small IT or security team

What to know

Although rated low by NVD, the flaw is in CISA's KEV catalogue and was used in real attacks, so the score alone understates the risk. [1][3]

What to do

  1. Inventory ESX hosts and review Broadcom's advisory for the fix. [1]
  2. Use CISA's November 11 due date for federal agencies as a reference for patch planning. [3]
  3. Review who holds administrative access to ESX hosts, since the flaw requires administrative privileges. [2]

Large enterprise

A security operations team

What to know

Because the flaw lets administrative actions go unlogged, missing log entries on ESX hosts could hide activity. CrowdStrike attributes the use to Warp Panda, per The Hacker News. [2][1]

What to do

  1. Identify all ESX hosts and apply the fix listed in Broadcom's advisory. [1]
  2. Review administrative access to ESX hosts and hunt for activity by accounts with administrative privileges, using CrowdStrike's reporting. [2][1]

Sources

  1. [1]The Hacker News · Oct 29, 06:22 UTC
    China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibilitycontext
  2. [2]SecurityWeek · Oct 29, 08:01 UTC
    Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Daycontext
  3. [3]CISA Advisories · Oct 28, 12:00 UTC
    CISA Adds Two Known Exploited Vulnerabilities to Catalogcontext