Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

SecurityWeek reports that the exploited flaw is described as a low-severity insufficient logging issue. It allows attackers logged in as administrators to perform certain operations without being logged.[1] The Hacker News gives the flaw a CVSS score: 2.7[2].According to SecurityWeek, CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within the next two weeks.[1] Cyber Press reports that CISA set November 11, 2026, as the remediation deadline for affected federal agencies.[3]The Hacker News says CrowdStrike's 2026 Legal Threat Landscape Report found that Warp Panda "exploits internet-facing edge devices using zero-day vulnerabilities and custom malware to maintain covert, persistent access"[2]. The outlet adds that the group has a storied history of weaponizing zero-day vulnerabilities in Citrix NetScaler and Ivanti Connect Secure devices.[2]Cyber Security News reports that the researchers said WARP PANDA deployed several forms of malware within victims' VMware vCenter environments[4]. The outlet also says the flaw does not itself grant administrator rights.[4]SecurityWeek reports that VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 and newer releases contain the relevant patches.[1] According to Cyber Press, Broadcom lists no workaround for this vulnerability.[3]