A security flaw in Broadcom VMware ESX allowed a malicious actor with administrator access to carry out certain operations without those actions being logged. The vulnerability, CVE-2026-41709, has a CVSS score of 2.7.
CrowdStrike said Warp Panda exploited the flaw as a zero-day in early 2026, using it in attacks aimed at organisations in the US legal sector. The group’s aim was to reduce visibility in the audit trail that defenders use to examine an intrusion.
Warp Panda deployed custom malware including BRICKSTORM and SharpStorm in VMware vCenter environments. It also registered new MFA devices on compromised accounts to establish persistent access, allowing it to return undetected.
Broadcom issued an advisory for CVE-2026-41709 in July 2026. On Wednesday, CISA added the flaw to its Known Exploited Vulnerabilities catalog.
Federal Civilian Executive Branch agencies are recommended to apply the fixes by November 11, 2026.
Warp Panda is also known as Armory Castle, Clay Typhoon and VerdantBamboo. The group has previously weaponized zero-day vulnerabilities in Citrix NetScaler and Ivanti Connect Secure devices.
Mandiant attributed Warp Panda to the zero-day exploitation of CVE-2026-102764 in BeyondTrust Remote Support. That flaw is an improper origin validation vulnerability with a CVSS score of 9.3.
The VMware ESX issue matters because activity that goes unlogged can leave organisations with less evidence to detect an intrusion, establish its scope and respond to it.
Comments (0)