China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

CISA added CVE-2026-41709, a VMware ESX vulnerability, to its Known Exploited Vulnerabilities catalog following CrowdStrike's disclosure of active exploitation. The threat actor, identified as Warp Panda, a China-nexus group, weaponized the zero-day in attacks targeting the U.S. legal sector. The exploitation was designed to reduce audit trail visibility, hampering forensic and investigative efforts. The vulnerability affects Broadcom VMware ESX hypervisor software. The inclusion in KEV signals urgent remediation requirements for federal agencies and critical infrastructure operators.