[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI8PcyhFYzTJdMh1ovGNZoIYyBDSJNQs6ST1pM44ussE":3},{"article":4,"iocs":55,"watch_terms":66,"solutions":67,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"3fe61325-ba85-4147-a6e8-255268a5cb8b","Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day","chinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day-6fa958","CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek.","Chinese threat actor Warp Panda has been exploiting a low-severity VMware ESXi vulnerability, CVE-2026-41709, as a zero-day in attacks against US organizations. This flaw allows administrators to perform actions without logging, reducing audit trail visibility. CISA has added it to its Known Exploited Vulnerabilities catalog, urging patching.","Chinese hackers exploit VMware ESXi logging flaw as zero-day.","https:\u002F\u002Fwww.securityweek.com\u002Fchinese-hackers-quietly-used-low-severity-esxi-logging-flaw-as-zero-day\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2022\u002F08\u002FVMWare.jpg","2026-10-29T08:01:05+00:00","2026-10-29T09:00:04.481606+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Warp Panda","threat_actor",{"name":21,"type":22},"VMware ESXi","product",{"name":24,"type":22},"VMware vCenter",{"name":26,"type":27},"VMware","vendor",{"name":29,"type":27},"Broadcom",{"name":31,"type":27},"CISA","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63],{"type":57,"value":58,"context":59},"cve","CVE-2026-41709","Exploited VMware ESXi logging flaw used by Warp Panda.",{"type":57,"value":61,"context":62},"CVE-2026-59309","Critical severity authentication bypass targeted in the wild.",{"type":57,"value":64,"context":65},"CVE-2026-59310","Critical directory traversal leading to arbitrary code execution, targeted in the wild.",[26,29,31],{"controls":68,"vendors":155},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":99,"product_name":123,"url":124,"description":125},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":127,"name":128,"problem":129,"products":130},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-pipelines","Abstract Pipelines","https:\u002F\u002Fwww.abstract.security\u002Fplatform\u002Fcollection","Collects security data from any source, normalises it in the pipeline and routes it to several destinations.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-transit","GreyMatter Transit","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Ftransit\u002F","Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"databahn","DataBahn","\u002Fvendor-logos\u002Fdatabahn.png","databahn-data-pipeline","DataBahn Data Pipeline","https:\u002F\u002Fwww.databahn.ai\u002Fproducts\u002Fdata-pipeline","Collection at the edge, transformation and routing of security data to SIEMs and data lakes, with an AI agent for managing the pipelines.",[156],{"slug":157,"name":158,"logo_path":159,"roles":160},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[161],"reported_by",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":174},"low-severity-esxi-logging-flaw-exploited-as-zero-day-by-chinese-hackers","Low-Severity ESXi Logging Flaw Exploited as Zero-Day by Chinese Hackers","Chinese threat actor Warp Panda exploited CVE-2026-41709, a low-severity VMware ESXi vulnerability, to perform administrative actions without generating audit logs — effectively blinding defenders to malicious activity. The incident highlights the dangerous assumption that low-severity vulnerabilities pose minimal risk; in reality, flaws that undermine logging integrity can be weaponized to conceal far more destructive operations. Because the flaw suppressed audit trail visibility, compromised environments had reduced ability to detect, scope, or respond to the intrusion in a timely manner. CISA's addition of the flaw to its Known Exploited Vulnerabilities (KEV) catalog underscores that severity ratings alone should not dictate patching urgency — active exploitation changes the calculus entirely.",[167,168,169,170,171,172,173],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(b)":175,"MITRE ATT&CK T1566: Phishing":176,"NIST SP 800-53 SI-2: Flaw Remediation":177,"OWASP A06:2021 Vulnerable and Outdated Components":178,"CIS Control 7: Continuous Vulnerability Management":179,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":180,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":181},"NIS2 requires incident handling measures including logging and monitoring of essential systems; the logging gap introduced by this vulnerability directly violates the spirit of this obligation and would have been caught under a compliant monitoring regime.","While the initial vector may vary, Warp Panda commonly uses spearphishing for initial access; awareness of this TTP should prompt defenders to monitor post-access lateral movement to hypervisor layers where this logging flaw could be leveraged.","SI-2 requires organisations to identify, report, and correct information system flaws; had this control been applied with urgency to the ESXi logging vulnerability, the exploitation window would have been significantly reduced.","Running an unpatched ESXi version containing a known logging vulnerability is a direct instance of using a vulnerable component, and remediation aligns precisely with the OWASP guidance to maintain an inventory and promptly update affected software.","A continuous vulnerability management programme that tracks and remediates all CVEs — regardless of severity — would have identified and patched CVE-2026-41709 before Warp Panda could weaponise it as a zero-day.","This control mandates timely identification and remediation of technical vulnerabilities, including those rated low severity, which would have prompted patching of the ESXi flaw before active exploitation occurred.","Restricting who can perform administrative actions on ESXi hosts — and ensuring those actions are always logged — aligns with PR.AA and would have limited the attacker's ability to exploit the logging suppression flaw undetected."]