China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

vulnerability

China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

Chinese-linked threat actor Warp Panda (also known as Armory Castle, Clay Typhoon, and VerdantBamboo) exploited a zero-day vulnerability (CVE-2026-41709) in VMware ESX to reduce audit trail visibility, targeting the U.S.…

The Hacker News · 7h ago CriticalCVSS 9.8KEVEPSS 19%

CVE-2026-41709 CVE-2026-102764 CH zero-day audit logging vmware

vulnerability

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Chinese hackers, specifically the Warp Panda group, have been exploiting a low-severity logging flaw in VMware ESXi to gain unauthorized access and deploy malware within US organizations.

SecurityWeek · 5h ago CriticalCVSS 9.8KEVEPSS 3%

CVE-2026-41709 CVE-2026-59309 CVE-2026-59310 CN zero-day logging vulnerabilities

news.mlab.sh

China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day