CISA Adds VMware ESX Flaw to Exploited List After CrowdStrike Ties It to China-Linked Warp Panda

A security flaw rated 2.7 out of 10 turned out to be a useful tool for Chinese state-linked spies.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday, Oct. 28, added CVE-2026-41709, a flaw in Broadcom's VMware ESX, to its Known Exploited Vulnerabilities (KEV) catalog. The listing follows CrowdStrike's 2026 Legal Threat Landscape Report, which says a China-nexus actor called Warp Panda exploited the bug as a zero-day in early 2026.

Federal civilian agencies are urged to apply the fix.

What the flaw does

CVE-2026-41709 is an insufficient-logging bug. An attacker who already has admin access can perform certain operations on ESX without those actions being recorded.

That is why the score is so low. Broadcom's July 2026 advisory, which shipped the patched versions, treats it as a minor issue.

CrowdStrike's point is that the flaw was never the way in. It was the way to stay hidden. Warp Panda used it, the report says, to reduce audit trail visibility, which means investigators have less to work with afterward.

Who Warp Panda is

CrowdStrike describes Warp Panda as a group that exploits internet-facing edge devices with zero-days and custom malware to keep "covert, persistent access." The group is also tracked as Armory Castle (formerly UNC5221), Clay Typhoon and VerdantBamboo.

It has a record of weaponizing zero-days in Citrix NetScaler and Ivanti Connect Secure devices.

The typical intrusion starts at an edge device. From there the group pivots into VMware vCenter environments and deploys custom malware, including BRICKSTORM and SharpStorm.

Some intrusions also reached cloud services. CrowdStrike says the group steals session tokens to get into Microsoft 365 without triggering credential-based alerts. In at least one case it registered a new multi-factor authentication device on a compromised account, so access would survive a password change.

Why law firms

CrowdStrike called Warp Panda "a sustained and strategically focused China-nexus cyber espionage threat to U.S. entities across multiple sectors, including the legal sector."

The report explains the target selection: "The legal sector's concentration of client communications, merger and acquisition materials, active litigation strategy, and cross-client access makes it a high-value collection target for a state-directed adversary seeking intelligence with downstream operational utility."

One law firm holds the secrets of many clients. A single breach can expose all of them.

BeyondTrust, too

The ESX listing is not the group's only recent activity. Google-owned Mandiant attributed Warp Panda to zero-day exploitation of CVE-2026-102764, a critical improper origin validation flaw in BeyondTrust Remote Support with a CVSS score of 9.3. Mandiant says the group used it to deliver malware families called SAWFLY and BARECLAW.

That bug is the opposite of the ESX one. It is rated critical, and it sits in a tool widely used for remote administration.

A separate China-aligned campaign

Microsoft said on Oct. 21 that a different group, Storm-0940, which it has tracked since 2021 and describes as China state-aligned, compromised the credentials of ConnectWise's Cloud Backup application, formerly known as SkyKick.

The stolen credentials let the attackers use access that customers had already granted to ConnectWise applications in their Microsoft cloud environments.

Microsoft says the group used ARTEX, a Chinese-developed AI security-testing tool, to automate attacks on hundreds of organizations. Targets included government agencies, defense contractors, financial institutions and technology companies. In multiple cases, Microsoft says, the attackers had privileged access to cloud systems less than three hours after first targeting a victim.

ConnectWise confirmed unauthorized access to application identities tied to Cloud Backup in a statement to The Epoch Times on Oct. 26. The company disabled the affected application connections, which interrupted Cloud Backup and two integrated services, SaaS Security and Cloud Management.

The company says it has found no indication that customer backup data was compromised. It says it has remediated the identified compromised credentials and identities, and has seen no successful threat activity in the environments it monitors since.

CEO Manny Rivelo said the evidence, including intelligence from Microsoft, points to a China state-aligned group. He added a caution: fixing ConnectWise's own systems "do not remove unauthorized access that may already have been established within individual customer tenants, which require separate review."

Microsoft has not been quoted tying Storm-0940 to Warp Panda, and the two campaigns should not be read as one operation.

What comes next

As of an Oct. 26 update, ConnectWise was still preparing a phased restoration of Cloud Backup. Access to existing backups would come first, followed by full service re-enrollment.

The company has not announced when partners can begin restoring data. It has told customers to keep affected application connections disabled until it issues restoration instructions, and to examine their Microsoft 365 environments for signs of unauthorized access.

For VMware shops, the practical step is the one CISA is pushing: confirm the July Broadcom fix is installed. A bug scored 2.7 is now on a federal list of flaws attackers are using.