Chinese Hackers Exploit VMware ESXi 0-Day to Hide Malicious Activity on Compromised Servers

Chinese-linked hackers exploited a VMware ESXi zero-day vulnerability to hide activity on compromised servers during espionage operations against U.S. organizations, including law firms. CrowdStrike identified the group as WARP PANDA and said it used the flaw, tracked as CVE-2026-41709, in several intrusions, with exploitation continuing into early 2026.

The findings appear in CrowdStrike’s 2026 Legal Threat Landscape Report, published on October 28. Researchers said WARP PANDA deployed several forms of malware within victims’ VMware vCenter environments, using the ESXi command logging bypass as a zero-day during some of those attacks.

The case highlights how a low-rated security flaw can help attackers stay hidden after gaining control. Rather than opening the door to a server, this vulnerability lets an attacker with administrator access perform certain actions without leaving the expected log records.

VMware ESXi Logging Bypass Works

Broadcom’s security advisory describes CVE-2026-41709 as an insufficient logging vulnerability in VMware ESX. It carries a CVSS score of 2.7 and a Low severity rating. Broadcom credits CrowdStrike researcher Ian Barton with reporting the issue.

The access requirement matters. This is not an unauthenticated remote code execution flaw, and it does not itself grant administrator rights. Its value comes after compromise, when a malicious administrator can use it to carry out certain operations without those actions being logged. Broadcom does not publicly list the specific operations affected.

That missing evidence can make an investigation harder. If defenders depend on the affected logs to reconstruct an intrusion, some attacker actions may be absent. However, the advisory does not say the flaw erases existing records or disables every source of monitoring, an important limit when assessing its impact.

Cyber Security News previously covered the issue within its report on critical VMware authentication bypass and other vulnerabilities. Those flaws appeared in the same advisory, but they have different access requirements and effects. CrowdStrike’s public summary does not establish that WARP PANDA used them together.

CrowdStrike’s reporting period ran from September 1, 2025, through August 31, 2026. Law firms hold privileged communications, merger details, intellectual property, government-related material, and financial records. That mix makes them valuable targets for both intelligence collection and data theft.

WARP PANDA was one of four prominent China-linked groups identified in the report. In April 2026, TITAN PANDA exploited a hardcoded IIS machine key vulnerability in Intapp Time Server, a timekeeping and billing product used almost exclusively by law firms.

MURKY PANDA’s ORB28 password spraying campaign affected more than 340 mainly U.S. organizations across several sectors, with legal entities hit hardest. At one law firm, researchers recorded nearly 500 failed login attempts against as many accounts, originating from about 300 IP addresses over 30 days. CrowdStrike noted that this campaign fell slightly outside its reporting period.

OVERCAST PANDA separately targeted executives at a U.K. legal firm in September and October 2025. These cases show distinct approaches, not one shared operation.

Patches Released

Broadcom lists fixed builds for the logging flaw as ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389. VMware Cloud Foundation 5.x users should consult the 5.2.4 update guidance, while affected Telco Cloud Platform deployments have separate instructions in KB449886. No workaround is listed.

Cyber Security News has also reported on the VMware ESX logging vulnerability being exploited. Administrators should match their exact product and release to Broadcom’s response matrix rather than assume every VMware update fixes this issue.

For prioritization, CISA’s Known Exploited Vulnerabilities catalog provides a useful input alongside vendor guidance and observed threats. Here, CrowdStrike’s documented zero-day use gives defenders a clear reason to assess exposure despite the flaw’s low numerical severity score.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?