CrowdStrike links VMware logging flaw exploitation to legal-sector attacks
Image: Primary CrowdStrike reported that the China-linked hacking group Warp Panda exploited a VMware ESX logging vulnerability as a zero-day in early 2026 to reduce audit trail visibility in attacks targeting the U.S. legal sector, The Hacker News reported. The flaw, CVE-2026-41709, allows an attacker with administrator access to perform certain operations without logging them.
Broadcom released fixes in July 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Wednesday, with federal civilian agencies recommended to apply fixes by November 11. CrowdStrike also described intrusions involving stolen cloud session tokens and registration of rogue multifactor authentication devices to maintain access.
Sources
In this story
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
