China-linked Warp Panda exploited VMware ESX flaw to hide its tracks, CISA warns

CISA added a VMware ESX vulnerability, CVE-2026-41709, to its Known Exploited Vulnerabilities catalog on October 28 after CrowdStrike reported that a China-nexus threat actor had used it as a zero-day to cover its tracks on compromised hosts. The Hacker News, citing CrowdStrike's 2026 Legal Threat Landscape Report, says the group known as Warp Panda exploited the flaw to reduce audit-trail visibility.

What happened

According to CrowdStrike's reporting as relayed by The Hacker News, the flaw is an insufficient-logging issue: an actor who already holds admin access can carry out certain operations on VMware ESX without those actions being recorded. Broadcom first disclosed and fixed the bug in a July 2026 advisory, but CrowdStrike says Warp Panda had already been abusing it as a zero-day in early 2026. The flaw carries a low CVSS score of 2.7 despite the confirmed exploitation, reflecting that it is an evasion aid rather than a direct code-execution bug.

Technical details

The Hacker News reports that Warp Panda — also tracked as Armory Castle (formerly UNC5221), Clay Typhoon and VerdantBamboo — typically gains initial access through internet-facing edge devices, then pivots into VMware vCenter environments and deploys custom malware including BRICKSTORM and SharpStorm for persistence. CrowdStrike says the group "actively circumvents detection by bypassing audit logging," harvests cloud session tokens and registers rogue multi-factor authentication (MFA) devices. In some intrusions it used stolen session tokens to reach Microsoft 365 without triggering credential-based alerts, and in at least one case it enrolled a new MFA device on a compromised account so that access would survive a password reset. The reporting adds that Google-owned Mandiant separately attributed the same group to zero-day exploitation of a BeyondTrust Remote Support flaw, CVE-2026-102764 (CVSS 9.3), earlier in October, used to deliver SAWFLY and BARECLAW malware.

Who is affected

CrowdStrike says Warp Panda has concentrated on U.S. entities across multiple sectors, singling out the legal sector, and has a history of exploiting zero-days in Citrix NetScaler and Ivanti Connect Secure devices. Broadcom's July advisory lists fixes across VMware Cloud Foundation, vSphere Foundation, ESX, Telco Cloud Platform and related builds.

What to do

The Hacker News says the core recommendation is to apply Broadcom's July 2026 fixes; CISA requires U.S. Federal Civilian Executive Branch agencies to patch by November 11, 2026. Given the described tactics, organizations may also want to confirm that audit logging on ESX and vCenter is intact, watch for unexpected MFA-device registrations and monitor for anomalous cloud session-token use — steps consistent with the reported behavior rather than specific advisory guidance.