Asl matn EN tilida, manba saytidan olindi. Manba ↗

Vulnerabilities

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged.

By

Ionut Arghire

| October 29, 2026 (4:01 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

The US cybersecurity agency CISA on Wednesday warned that hackers have been exploiting another VMware ESXi vulnerability in attacks.

Tracked as CVE-2026-41709, the exploited flaw is described as a low-severity insufficient logging issue. It allows attackers logged in as administrators to perform certain operations without being logged.

The security defect was disclosed on July 29 alongside three critical and one high-severity bug in VMware vCenter, ESXi, Workstation, and Fusion.

VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 and newer releases contain the relevant patches.

CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within the next two weeks.

CISA did not provide details on the observed exploitation, but CrowdStrike reported on Wednesday that the China-nexus threat actor Warp Panda had exploited CVE-2026-41709 as a zero-day in intrusions at US organizations, including law firms.

Advertisement. Scroll to continue reading.

According to CrowdStrike, Warp Panda typically gains initial access through internet-facing edge devices and pivots to VMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.

In several of those attacks, and as late as early 2026, the group used CVE-2026-41709 to significantly reduce audit trail visibility.

At least two other security defects described in Broadcom’s July 29 advisories have been targeted in the wild, namely CVE-2026-59309 (a critical-severity authentication bypass) and CVE-2026-59310 (a critical directory traversal issue leading to arbitrary code execution).

In mid-August, cybersecurity company Quirso said an APT had been exploiting CVE-2026-59310 to compromise approximately 360 web-accessible VMware vCenter servers and deploy an SSH reverse shell.

Later, Quirso attributed the activity to a China-linked threat actor and warned that CVE-2026-59309 had been exploited as well, likely before CVE-2026-59310, potentially by a different threat actor.

Mass targeting of CVE-2026-59310 was flagged in early September.

Related:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Related:TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

Related:China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Related:Long-Hidden Flaws Patched in EPICS Research Facility Control Software

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Hackers Start Probing Fresh Oracle EBS Vulnerability
  • Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
  • HPE Patches Dozens of Critical Flaws in Networking Products
  • Unexplained DreamHost Incident Prompts Email, FTP Password Resets
  • Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
  • Genesys Hack Exposes Customer Data From Internal Systems
  • 953 Online Stores Infected in Long-Lasting Malware Campaign
  • Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts

Latest News

  • Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
  • Upwind Security Raises$400 Million at$3.8 Billion Valuation
  • Chrome and Firefox Updates Patch Over 200 Vulnerabilities
  • TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
  • China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  • Long-Hidden Flaws Patched in EPICS Research Facility Control Software
  • Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
  • Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise

Trending

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

HPE Patches Dozens of Critical Flaws in Networking Products

PHP2Shell Exploitation Moves From Probes to Working Shells

Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Quantum eMotion has named Wayne Teeple as CTO.

Guy Ellis has been appointed CEO of NCC Group.

Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)