Chinese Hackers Used a Logging Blind Spot in VMware to Hide Inside US Networks
A group tracked as Warp Panda quietly exploited a low-severity flaw in VMware ESXi to erase their tracks inside US law firms and other organisations. Three VMware vulnerabilities are now confirmed as actively exploited in the wild.
Key points
- CrowdStrike's Warp Panda cluster, a China-linked espionage group, used CVE-2026-41709 as a zero-day flaw (meaning a vulnerability that was unknown and unpatched at the time of attack) in intrusions at US organisations including law firms, as late as early 2026.
- CVE-2026-41709 carries a CVSS severity score of only 2.7 out of 10, yet CISA added it to its Known Exploited Vulnerabilities catalogue, giving federal agencies two weeks to patch.
- Two companion flaws in VMware vCenter, CVE-2026-59309 and CVE-2026-59310, both carry a CVSS score of 9.8 (critical) and are confirmed as exploited in the wild.
- Cybersecurity firm Quirso linked CVE-2026-59310 exploitation to roughly 360 internet-facing VMware vCenter servers being broken into, with attackers planting a backdoor called an SSH reverse shell.
Warp Panda ran a quieter play than the typical smash-and-grab intrusion.
VMware ESXi is software that lets organisations run many virtual computers on a single physical server. It sits at the heart of countless corporate and government data centres. VMware vCenter is the management console administrators use to oversee those virtual machines from one place. Together, they're some of the most sensitive software on any network.
How did the hackers get in and stay hidden?
Warp Panda typically enters through internet-facing devices at the edge of an organisation's infrastructure, then works inward toward vCenter. Once there, according to CrowdStrike, the group deployed custom malware tools including BrickStorm, TetanusStorm, SharpStorm and GuestConduit across intrusions throughout 2025.
Then came the clever part. CVE-2026-41709, the low-severity flaw, is an insufficient logging vulnerability in VMware ESXi. It let an attacker who already held administrator access carry out certain actions without those actions being written to the system's activity log. That log is the record defenders use to understand what happened on a network. Erase the footprints, and incident responders are flying blind.
That's why a flaw scoring 2.7 ended up on CISA's list of actively exploited vulnerabilities. Low severity doesn't mean low impact when the goal is long-term, undetected espionage. Capability and intent are different things, and Warp Panda's intent was clearly to stay invisible.
What are the two critical flaws?
The logging flaw didn't arrive alone. Broadcom published advisories for the full batch on 29 July 2026, which we first covered the same day.
| CVE | Product | Type | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-41709 | VMware ESXi | Insufficient logging | 2.7 (Low) | Exploited, federal patch deadline active |
| CVE-2026-59309 | VMware vCenter | Authentication bypass | 9.8 (Critical) | Exploited in the wild |
| CVE-2026-59310 | VMware vCenter | Directory traversal / code execution | 9.8 (Critical) | Exploited, mass targeting flagged early September |
CVE-2026-59310 is the most blunt: it let anyone with network access to vCenter run their own code on the server, no password required. Quirso reported in mid-August that roughly 360 publicly reachable vCenter servers had already been compromised this way, with attackers installing an SSH reverse shell, a tool that lets criminals maintain a persistent, hidden connection back to a compromised machine from outside. Mass targeting was flagged by early September.
CVE-2026-59309 is an authentication bypass in VMware's directory service, meaning attackers could walk past the login screen entirely. Quirso later suggested it was likely exploited before CVE-2026-59310, potentially by a different group.
Should ordinary people be worried?
Directly, no. These flaws target enterprise server software rather than personal devices. But indirectly, yes: law firms handle privileged client communications, and any organisation running unpatched VMware infrastructure is carrying real risk right now.
For IT and security teams, the practical answer is straightforward. Broadcom patches are available. VMware ESXi releases ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and newer contain the fixes for CVE-2026-41709. US federal agencies are under a hard legal deadline. Everyone else should treat that deadline as a useful benchmark.
The attribution picture is still forming. CrowdStrike's Warp Panda assessment is single-vendor at this point, and Quirso's vCenter findings point to at least one additional, possibly separate, China-linked cluster. For those tracking Chinese infrastructure operations, the seizure of Microscan and FishHub tools we reported on 9 October is worth reading alongside this. Medium confidence is the right posture until more vendors weigh in.
