China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

A security flaw in Broadcom VMware ESX has been added to the US Cybersecurity and Infrastructure Security Agency's list of known exploited vulnerabilities. The vulnerability was exploited by a China-linked threat actor known as Warp Panda in attacks on the US legal sector. This was discovered by CrowdStrike, who found that the threat actor used the flaw to reduce visibility of their actions in audit trails. The vulnerability in question has a CVSS score, indicating its severity. It is identified as CVE-2026-41709. The exploitation of this vulnerability was used in targeted attacks.