Hackers linked to China exploit a VMware ESXi/ESX vulnerability, CVE-2026-41709, to perform actions that are less likely to appear in system logs, according to multiple reports. SecurityWeek says attackers leveraged the issue as a zero-day and used administrative privileges to carry out operations while reducing logging visibility.
The Hacker News adds that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) lists the flaw in its Known Exploited Vulnerabilities (KEV) catalog. It also reports that CrowdStrike observed the vulnerability being weaponized by a China-nexus threat actor called Warp Panda, with targeting described as aimed at the U.S. legal sector. Across outlets, the common emphasis is on audit/logging evasion and the flaw’s real-world exploitation, while details differ in who disclosed it and which victim sector is highlighted.
