A 2.7 that silences logs

CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities catalog on Wednesday. It carries a CVSS score of 2.7, low because the bug does nothing to help an attacker get in. It is an insufficient-logging flaw in Broadcom VMware ESX: an actor who already holds admin access can perform certain operations without those operations being written to the audit trail.

CrowdStrike’s 2026 Legal Threat Landscape Report explains why a 2.7 ended up on the KEV list. The China-nexus group it tracks as Warp Panda exploited CVE-2026-41709 as a zero-day in early 2026 to cut audit-trail visibility inside the VMware environments of U.S. law firms. What the bug offers is silence in the audit log.

Broadcom disclosed and fixed the issue in an advisory in July 2026. The fixed builds:

• VMware Cloud Foundation: SXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025
• VMware vSphere Foundation: SXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025
• VMware ESX: ESXi80U3j-25429389
• VMware Cloud Foundation 5.2.4
• VMware Telco Cloud Platform: ESXi80U3j-25429389

Warp Panda does not start at vCenter. CrowdStrike says it gets initial access by exploiting internet-facing edge devices with zero-days, then pivots into VMware vCenter and deploys the BRICKSTORM and SharpStorm malware to hold access. CVE-2026-41709 is the part that keeps that activity out of the logs once the actor is operating with admin rights in the hypervisor.

The same approach extends to cloud. CrowdStrike says the group harvests cloud session tokens to reach Microsoft 365 without tripping credential-based alerts, since a stolen session skips the login those alerts watch for. In at least one intrusion it registered a new MFA device on a compromised account, giving it a way back in even after the password was changed.

Warp Panda also goes by Armory Castle (formerly UNC5221), Clay Typhoon, and VerdantBamboo, with a record of zero-day work against Citrix NetScaler and Ivanti Connect Secure. Earlier this month Mandiant tied the same crew to zero-day exploitation of CVE-2026-102764, a critical improper-origin-validation flaw in BeyondTrust Remote Support rated 9.3, used to deliver the SAWFLY and BARECLAW malware families.

The target set is deliberate. “The legal sector’s concentration of client communications, merger and acquisition materials, active litigation strategy, and cross-client access makes it a high-value collection target for a state-directed adversary seeking intelligence with downstream operational utility,” CrowdStrike said. A firm holds its clients’ secrets too, which is the point of going after the firm rather than each client.

For anyone running ESX, patching to the builds above closes the logging gap. It does not undo an intrusion that already used it, because the gap only ever mattered to an attacker who already held admin in the hypervisor. If you run internet-facing edge appliances in front of a vSphere estate, the more useful questions are whether vCenter admin activity is logged somewhere the hypervisor cannot suppress, whether M365 access is checked against session-token anomalies rather than failed logins, and whether MFA device registrations raise an alert. Those are the three behaviours CrowdStrike attributes to Warp Panda, and none of them show up as a failed credential.

FCEB agencies have until November 11, 2026 to apply the fixes.