Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Chinese threat actor Warp Panda exploited CVE-2026-41709, a low-severity VMware ESXi vulnerability, to perform administrative actions without generating audit logs — effectively blinding defenders to malicious activity. The incident highlights the dangerous assumption that low-severity vulnerabilities pose minimal risk; in reality, flaws that undermine logging integrity can be weaponized to conceal far more destructive operations. Because the flaw suppressed audit trail visibility, compromised environments had reduced ability to detect, scope, or respond to the intrusion in a timely manner. CISA's addition of the flaw to its Known Exploited Vulnerabilities (KEV) catalog underscores that severity ratings alone should not dictate patching urgency — active exploitation changes the calculus entirely.