> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Warp Panda exploits ESXi logging flaw CVE-2026-41709 to evade detection - URL: https://f4n6.co.uk/security-feed/warp-panda-exploits-esxi-logging-flaw-cve-2026-41709-to-evade-detection/ - Published: 2026-10-29T10:52:23.000Z - Updated: 2026-10-29T10:52:23.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-41709, CVE-2026-59309, CVE-2026-59310, Warp Panda ## 1\. Executive summary CISA added CVE-2026-41709, an insufficient-logging flaw in VMware ESXi rated CVSS 2.7 LOW (CWE-778), to the CISA KEV catalog on 2026-10-28\. CrowdStrike attributes exploitation as a zero-day to a China-nexus actor it calls Warp Panda, in intrusions at US organisations including law firms, with the flaw used to suppress audit-trail visibility. The same July 29 Broadcom advisory set contains two critical flaws that are also exploited in the wild: CVE-2026-59309 (CVSS 9.8, authentication bypass, CWE-303) and CVE-2026-59310 (CVSS 9.8, path traversal, CWE-22), the latter in CISA KEV since 2026-08-18\. For EMEA financial services the exposure is the management plane of the virtualisation estate: an actor who is already administrator on ESXi, or who reaches vCenter through the two critical flaws, can operate without leaving the audit records that incident response and DORA Art. 17 processes depend on. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The exploited flaw removes audit-trail visibility on ESXi, the platform on which detection and incident reconstruction depend | Incident management procedures must assume log gaps on virtualisation hosts; reconstruction has to draw on vCenter, network and backup telemetry, not host logs alone | | DORA Art. 24 | Two critical flaws in the same July 29 advisory set (CVE-2026-59309, CVE-2026-59310) are exploited in the wild against internet-reachable vCenter | Digital operational resilience testing scope must include authenticated and unauthenticated testing of vCenter and ESXi management interfaces, not only application-layer systems | | NIS2 Art. 21(2)(d) | Exploitation reaches clients through VMware/Broadcom virtualisation products in the ICT supply chain | Supply chain security measures must cover hypervisor and management-plane vendors: patch intake, version tracking and vendor advisory monitoring for ESXi and vCenter | ## 3\. Technical analysis & attack chain CVE-2026-41709 is an insufficient-logging defect (CWE-778) in VMware ESXi. An attacker already logged in with administrative rights can perform certain operations that are not written to the audit log. The CVSS base score is 2.7 LOW, which reflects the precondition of administrative access rather than the effect: the flaw's value to an intruder is that it removes the record of what they did after they obtained that access. CISA added it to KEV on 2026-10-28\. EPSS is 0%. Confirmed steps, as reported: 1. Initial access through internet-facing edge devices. CrowdStrike describes this as Warp Panda's typical entry route. 2. Pivot to VMware vCenter. 3. Deployment of malware from the set CrowdStrike names: BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit. These were deployed in intrusions through 2025. 4. Use of CVE-2026-41709, in several of those attacks and as late as early 2026, to reduce audit-trail visibility. The source does not describe the mechanism by which the logging gap is triggered, which ESXi operations go unrecorded, or how administrative access was obtained before the flaw was used. It also gives no command lines, file paths, service names or C2 addresses for the five malware families. Defenders should not expect this advisory to support host-based hunting on the ESXi side beyond the version check in §4. The parallel exploitation of the two critical flaws is better documented. CVE-2026-59310 is a directory traversal (CWE-22) leading to arbitrary code execution, CVSS 9.8, in KEV since 2026-08-18, EPSS 3%. Quirso reported in mid-August that an APT exploited it against approximately 360 web-accessible vCenter servers and deployed an SSH reverse shell, and attributed the activity to a China-linked actor. Quirso also reported that CVE-2026-59309, an authentication bypass (CWE-303, CVSS 9.8, not in KEV, EPSS 1%), was exploited as well, likely before CVE-2026-59310 and potentially by a different actor. Mass targeting of CVE-2026-59310 was flagged in early September. The 360-server figure and the SSH reverse shell are single-sourced to Quirso; verify before using them as a scoping basis. Attribution caveat: Warp Panda has no MITRE ATT&CK profile. The attribution to a China-nexus actor rests on CrowdStrike's reporting as relayed by SecurityWeek and The Hacker News, and the link between Warp Panda and the Quirso-reported vCenter campaign is not established in the source. Treat both as unconfirmed. CISA's KEV addition confirms exploitation in the wild but gives no actor detail. ## 4\. Mitigation & containment ### P1, within 24 hours - Inventory every ESXi host and record its build. The patched builds named by Broadcom are ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389, with "and newer" applying to each. Any host below these builds is exposed to CVE-2026-41709 and, where vCenter is reachable, to CVE-2026-59309 and CVE-2026-59310. - Patch CVE-2026-59310 and CVE-2026-59309 first on any vCenter instance reachable from the internet or from a partner network. These are the remote, unauthenticated paths; CVE-2026-41709 requires existing administrative access. CISA's KEV remediation deadline for CVE-2026-59310 has passed (added 2026-08-18); no remediation due-date is stated in the source for CVE-2026-41709 beyond CISA's two-week federal window. - Remove direct internet exposure from vCenter and ESXi management interfaces. Put them behind a management VLAN or VPN with MFA. The Quirso campaign targeted web-accessible vCenter, and Warp Panda's entry route is internet-facing edge devices. - Hunt for SSH reverse shells originating from vCenter appliances: outbound SSH from the vCenter host to external or unexpected internal addresses, and any authorised\_keys or shell startup modification on the appliance. This is the payload Quirso reported; single-sourced, so corroborate against your own vCenter egress baseline before raising incidents. ### P2, within 72 hours - Pull and preserve vCenter and ESXi logs for the period since the last known-good build, and compare host-level audit coverage against vCenter tasks and events for the same window. A host that shows administrative operations in vCenter with no corresponding host audit entries is the signature of CVE-2026-41709 use. - Restrict ESXi administrative access to named accounts with MFA at the management layer, and remove shared root or administrator credentials. The flaw's precondition is administrative login; reducing who holds it reduces the population who can use it silently. - Forward ESXi and vCenter logs to a remote collector that the hypervisor administrator cannot modify. This is the control the flaw defeats when logs live only on the host. ### P3, within 7 days - Add the three CVEs to vulnerability-management exception review so that CVE-2026-41709 is not deprioritised on its 2.7 score. Its KEV status overrides the base score for prioritisation. - Review DORA Art. 17 incident playbooks for the log-gap case: name the alternate evidence sources (vCenter events, network flow, backup and snapshot metadata) that reconstruction will use when host logs are missing. - Confirm VMware/Broadcom advisory intake covers ESXi, vCenter, Workstation and Fusion, since the July 29 disclosure spanned all four products. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe behaviours only. Behavioural indicators | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------------- | | Administrative operations on ESXi with no corresponding host audit-log entry | ESXi host logs compared against vCenter tasks and events | Medium; described by CrowdStrike via SecurityWeek, no mechanism given | | SSH reverse shell established from a vCenter server | vCenter appliance process and network telemetry, egress firewall | Low; single-sourced to Quirso | | Malware families BrickStorm, TetanusStorm, SharpStorm, DualGauge, GuestConduit deployed after vCenter compromise | vCenter and guest telemetry; no file or process detail available | Low; named by CrowdStrike, no artefacts published in the source | | Initial access via internet-facing edge devices followed by vCenter pivot | Edge-device and perimeter logs | Medium; CrowdStrike's stated typical pattern | ## 6\. Detection Insufficient indicators to author detection rules. The sources name malware families and describe a logging gap but publish no strings, command lines, file names, registry keys or network artefacts from which a YARA or Sigma rule could be built. A rule keyed on the CVE identifiers or family names would detect reporting about the activity, not the activity. Detection for this item rests on the behavioural comparisons in §5: host-versus-vCenter log reconciliation and vCenter egress monitoring. ## CVE assessment 3 referenced CVEs — **2 actively exploited (CISA KEV)**, 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-59310](https://nvd.nist.gov/vuln/detail/CVE-2026-59310?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-08-18 | 3% | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCen… | | [CVE-2026-41709](https://nvd.nist.gov/vuln/detail/CVE-2026-41709?ref=f4n6.co.uk) | 2.7 Low | ⚠ KEV 2026-10-28 | 0% | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certai… | | [CVE-2026-59309](https://nvd.nist.gov/vuln/detail/CVE-2026-59309?ref=f4n6.co.uk) | 9.8 Critical | — | 1% | VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network… | ## 7\. Sources - SecurityWeek, "Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day", 2026-10-29\. https://www.securityweek.com/chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day/ - The Hacker News, "China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility", 2026-10\. https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html - NVD, EPSS and CISA KEV records for CVE-2026-41709, CVE-2026-59309 and CVE-2026-59310 (CVSS, CWE and KEV status as stated in §1 and §3). - CrowdStrike reporting on Warp Panda, as relayed by SecurityWeek and The Hacker News; the primary CrowdStrike publication was not supplied and should be obtained before relying on the malware family names. - Quirso reporting on the vCenter campaign, as relayed by SecurityWeek; single-sourced. ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-41709 as CVSS 2.7 LOW but operationally significant because it is in CISA KEV and because it degrades the evidence base for incident response on the virtualisation tier; we do not re-rate the severity upward, and we treat the Warp Panda attribution as unconfirmed since the actor has no MITRE ATT&CK profile and the claim rests on CrowdStrike reporting relayed second-hand. The greater client impact sits with CVE-2026-59310 and CVE-2026-59309, both CVSS 9.8, one in KEV since 2026-08-18, which give remote access to vCenter without the administrative precondition. We will obtain the primary CrowdStrike and Quirso publications to extract host and network artefacts for hunting rules, and we will reissue this advisory if those sources yield indicators usable in §5 and §6\. Clients should confirm their ESXi build against the three patched versions in §4 and report back any host whose audit coverage does not reconcile with vCenter events. --- [Read the original source →](https://www.securityweek.com/chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*