# CrowdStrike links VMware logging flaw exploitation to legal-sector attacks

_Published Friday, October 30, 2026 at 11:18 PM EDT · Security · Latest · Tier 2 — Notable_

![CrowdStrike links VMware logging flaw exploitation to legal-sector attacks — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcr5vMvEpNtC6AAPL85NwoZLwafJYuuIYKlofAez4dmACEH-0VI-icaKusP2b9HgxcJC2AMyZkdGNfVOyXQCWqjK-_vIvw1OjptUH_maUL82An7MRxEnZQ62JZqPqwuTp6QQ8TWq4y0SRqUb6KhdXLYRJMyUHg2cQBzez3g-0G8jh2ujIgx-6FqQdWBuFr/s1700-nu-rw-lo-l85-e365/esx-audit.jpg)

CrowdStrike reported that the China-linked hacking group Warp Panda exploited a VMware ESX logging vulnerability as a zero-day in early 2026 to reduce audit trail visibility in attacks targeting the U.S. legal sector, The Hacker News reported. The flaw, CVE-2026-41709, allows an attacker with administrator access to perform certain operations without logging them.

Broadcom released fixes in July 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on Wednesday, with federal civilian agencies recommended to apply fixes by November 11. CrowdStrike also described intrusions involving stolen cloud session tokens and registration of rogue multifactor authentication devices to maintain access.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html)

---
Canonical: https://techandbusiness.org/newswire/SJWNdCfKcWv-Hup5ivNRcd
Published: 2026-10-31T03:18:18.845Z
Story chronology: 2026-10-29T06:22:00.000Z
Retrieved: 2026-10-31T05:57:29.548Z
Publisher: Tech & Business (techandbusiness.org)