China-Linked Hackers Exploit VMware ESX Zero-Day CVE-2026-41709 in Legal Sector Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, following revelations from CrowdStrike that the vulnerability had been weaponized by a China-nexus threat actor known as Warp Panda. The attacks targeted the U.S. legal sector. The vulnerability, tracked as CVE-2026-41709, was exploited to reduce audit trail visibility in VMware ESX environments. CISA's KEV catalog entry mandates that organizations address the flaw by the known deadline. CrowdStrike's analysis attributed the exploitation activity to a threat actor associated with the People's Republic of China, though the advisory does not detail the specific technical mechanism beyond the impact on logging and audit functions. Broadcom and VMware have not published a patch statement at the time of reporting, but CISA's inclusion in the KEV catalog signals that a fix is available or imminent. Organizations using VMware ESX are advised to apply the recommended security update immediately.