China-Linked Group Exploited VMware Zero-Day to Evade Audit Trails

CISA has added a Broadcom VMware ESX security flaw, CVE-2026-41709, to its Known Exploited Vulnerabilities catalog. CrowdStrike reported that a China-nexus threat actor, Warp Panda, exploited this zero-day vulnerability, which is an insufficient logging flaw, in attacks targeting the U.S. legal sector. The exploit allowed malicious actors with administrative access to operate without being recorded, reducing audit trail visibility.