Warp Panda Abused VMware ESX Logging Flaw to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog after researchers linked the flaw to active exploitation by a China-nexus threat actor known as Warp Panda. CrowdStrike’s reporting indicates the adversary used the vulnerability as a zero-day in early 2026 to limit audit logging, enabling covert and persistent access in targeted environments—most notably in the U.S. legal sector. The vulnerability: CVE-2026-41709…