Once Inside, Hackers Used a 'Low-Risk' Bug to Hide Their Tracks

A VMware bug rated just 2.7 out of 10 let intruders who already held admin rights on ESX hosts do certain things without leaving a log entry. CISA added CVE-2026-41709 to its exploited-vulnerabilities catalog on October 28, 2026, after CrowdStrike reported a China-linked group used it as a zero-day. Victims included US legal-sector targets; the bug dimmed the security cameras after the burglar was inside.

TL;DR

• CrowdStrike says China-linked Warp Panda exploited VMware ESX flaw CVE-2026-41709 as a zero-day; CISA added it to KEV on October 28, 2026.
• Client ESX 9.1, 9.0 or 8.0 hosts below the fixed builds in Broadcom's VMSA-2026-0006 are exposed; one PowerCLI (VMware's PowerShell tool) command lists every build.
• Preserve logs, patch, turn on remote ESXi audit records, then hunt logs since 2025-12-01 for the indicators in CrowdStrike's Warp Panda profile.
• The bug only helps someone already holding admin rights; CrowdStrike's research shows the group often enters through internet-facing edge devices, then pivots to vCenter, VMware's management console.

What is CVE-2026-41709 and is it being exploited?

CVE-2026-41709 is an insufficient-logging weakness in Broadcom VMware ESX, the hypervisor that runs a server's virtual machines: Broadcom's advisory says "a malicious administrator could perform certain operations without them being logged." It is exploited: CrowdStrike's 2026 Legal Threat Landscape Report says Warp Panda, a China-nexus espionage group, used this ESXi command logging bypass "as a zero-day" in several cases, as late as early 2026. It entered the CISA KEV catalog on 2026-10-28, with a 2026-11-11 due date for federal agencies. Its CVSS score of 2.7 is low because the attacker must already be an administrator.

Which VMware ESX versions are affected?

ESX 9.1, 9.0 and 8.0 below the builds below are affected, including hosts inside VMware Cloud Foundation and vSphere Foundation; Broadcom lists no workaround.

Fixed builds from Broadcom's VMSA-2026-0006. The CVE record omits ESX 7.0, but the advisory's response matrix lists 7.0 hosts for this CVE with fixes only through Broadcom Support under extended support, so treat 7.0 as affected. Telco Cloud Platform 5.0.x and 5.1.x are also affected; the advisory points to Broadcom's Telco knowledge base article for their builds.

How do I check whether my clients' ESXi hosts are exposed or compromised?

Run these from an admin workstation with PowerCLI connected to all your clients' vCenters (or standalone hosts) at once, as step 2 shows; every loop then covers all of them. The hunt window starts 2025-12-01, 30 days before the "early 2026" zero-day use CrowdStrike reports. On-host logs cover far less, so search the client's SIEM or syslog archive; and because this bug hides some admin actions, a clean log can't rule out a break-in.

1. Preserve evidence. In the vSphere Client, right-click the vCenter object and choose Export System Logs with all hosts selected (Broadcom KB 326299), save the bundle to $D, copy the syslog archive, and hash both.

   $D = "C:\IR\$(Get-Date -Format yyyyMMdd)-esx"; New-Item -ItemType Directory $D -Force
   Get-ChildItem $D -Recurse -File | Get-FileHash -Algorithm SHA256 | Export-Csv "$D.sha256.csv" -NoTypeInformation
   

   D=/srv/ir/esx-$(date +%F); sudo mkdir -p "$D"; sudo cp -a <esxi-syslog-archive> "$D"/
   sudo find "$D" -type f -exec sha256sum {} + | sudo tee "$D.sha256"
   

2. Read every host's build. This is the decisive exposure check; it reports the build Broadcom's vmware -vl shows. Pass: 9.1 hosts at build 25370933 or higher, 9.0 at 25595025 or higher, 8.0.3 at 25429389 or higher; any 7.0 host, or 8.0 host below Update 3, fails.

   Set-PowerCLIConfiguration -DefaultVIServerMode Multiple -Scope Session -Confirm:$false
   Connect-VIServer -Server <vcenter-1>,<vcenter-2>,<standalone-host-1>
   Get-VMHost | Select-Object Name,Version,Build | Sort-Object Version,Build
   

3. Check that admin actions leave the host. This lists each host's remote log server and audit-record settings, using syslog config get and auditrecords get. Pass: LogHost names the client's syslog server or SIEM, and the audit settings show remote recording on.

   foreach ($h in Get-VMHost) { $c = Get-EsxCli -VMHost $h -V2
     [pscustomobject]@{ Host = $h.Name
       LogHost = (Get-AdvancedSetting -Entity $h -Name 'Syslog.global.logHost').Value
       Audit = ($c.system.auditrecords.get.Invoke() | Out-String).Trim() } }
   

4. Search for published indicators. These are the two IP addresses and four SHA-256 hashes in CrowdStrike's Warp Panda profile. Any IP hit, or any hash found by the client's EDR on guest VMs, means the host is compromised.

   sudo find <esxi-syslog-archive> <firewall-log-archive> -type f -newermt 2025-12-01 -exec zgrep -HE '208\.83\.233\.14|149\.28\.120\.31' {} +
   # hashes for the EDR search: 40db68331cb52dd3ffa0698144d1e6919779ff432e2e80c058e41f7b93cec042 88db1d63dbd18469136bf9980858eb5fc0d4e41902bf3e4a8e08d7b6896654ed 9a0e1b7a5f7793a8a5a62748b7aa4786d35fc38de607fb3bb8583ea2f7974806 40992f53effc60f5e7edea632c48736ded9a2ca59fb4924eb6af0a078b74d557
   

5. Look for vpxuser SSH logins. vpxuser is the account vCenter manages on each host; CrowdStrike says to treat any SSH session by it as likely malicious. Any hit means you should review that session.

   sudo find <esxi-syslog-archive> -type f -newermt 2025-12-01 -exec zgrep -HE 'sshd.*vpxuser' {} +
   

6. List accounts, permissions and port 8090 listeners. CrowdStrike says the group's Junction implant poses as the legitimate vvold service on port 8090, so check any listener there against whether the host uses vVols. Review any account or permission the client can't name.

   foreach ($h in Get-VMHost) { $c = Get-EsxCli -VMHost $h -V2
     $c.system.account.list.Invoke() | Select-Object @{n='Host';e={$h.Name}},*
     $c.network.ip.connection.list.Invoke() | Where-Object LocalAddress -like '*:8090' | Select-Object @{n='Host';e={$h.Name}},LocalAddress,ForeignAddress,State }
   Get-VIPermission | Sort-Object Principal | Select-Object Principal,Role,Entity
   

How do I fix CVE-2026-41709 on client ESXi hosts?

Install the fixed build from Broadcom, then make sure admin activity reaches a log the attacker can't touch.

1. Preserve evidence first: confirm $D and its hash file from check 1 exist before changing anything.

2. Contain: isolate any host with a hit in checks 4 or 5 and hand it to incident response; reinstall it from Broadcom media rather than patching in place.

3. Patch: apply the fixed build from the table, using Broadcom's VMSA-2026-0006. Pass: check 2 shows every host at or above it.

4. Remove footholds: remove permissions the client can't name with Remove-VIPermission, then turn off shell access for vpxuser and stop SSH, as CrowdStrike recommends for ESXi 8.0 and later.

   foreach ($h in Get-VMHost) { $c = Get-EsxCli -VMHost $h -V2
     $c.system.account.set.Invoke(@{id='vpxuser'; shellaccess=$false})
     Get-VMHostService -VMHost $h | Where-Object Key -eq 'TSM-SSH' | Stop-VMHostService -Confirm:$false
     Get-VMHostService -VMHost $h | Where-Object Key -eq 'TSM-SSH' | Set-VMHostService -Policy Off }
   

5. Send audit records off the host: enable local and remote audit records, point syslog at the client's collector over TCP 514 (Broadcom KB 318939), and send a test line. Pass: rerun check 3 and find each audit-test line in the SIEM.

   foreach ($h in Get-VMHost) { $c = Get-EsxCli -VMHost $h -V2
     $c.network.firewall.ruleset.set.Invoke(@{rulesetid='syslog'; enabled=$true}); $c.network.firewall.refresh.Invoke()
     $c.system.syslog.config.set.Invoke(@{loghost='tcp://<client-syslog>:514'})
     $c.system.auditrecords.local.enable.Invoke(); $c.system.auditrecords.remote.enable.Invoke()
     $c.system.syslog.reload.Invoke(); $c.system.syslog.mark.Invoke(@{message="audit-test $($h.Name)"}) }
   

6. Rotate credentials: after patching, change ESXi root and vCenter admin passwords, and require MFA through an identity provider for vCenter logins.

7. Close the outside door: from outside the client's network, run nmap -Pn -p 22,443,8090 <client-public-range>. Pass: no vCenter or ESXi login page answers. Finally rerun checks 2 to 6. Pass: every host is at a fixed build and sends audit records, with no indicators or unknown accounts.

Where KinoSec fits

An autonomous external pentest of a client surfaces the doors this chain needed: internet-facing edge devices with exploitable flaws, and vCenter or ESXi management pages reachable from outside. CrowdStrike's research shows Warp Panda often starts at exactly those edge devices. KinoSec does not inspect ESXi logging settings; checks 2 and 3 do that. What it tests is whether someone outside could reach the admin access this bug needs, chaining exploits across web apps, external networks and Active Directory, and writing up findings with remediation you hand to your client. Run it continuously across your client base, and the late-patched edge device or exposed vCenter page shows up as a finding before it becomes a foothold.

Frequently Asked Questions

Why would a bug rated 2.7 be on CISA's exploited list?

CISA lists bugs that are exploited, whatever their score. CVE-2026-41709 scores 2.7 because it needs an administrator, but CrowdStrike says Warp Panda used it as a zero-day to hide ESXi commands after breaking in.

Is VMware ESXi 7.0 affected by CVE-2026-41709?

Treat it as affected. The CVE record omits 7.0, but Broadcom's VMSA-2026-0006 response matrix lists 7.0 hosts for this CVE with fixes only through Broadcom Support under extended support.

How do I check if my clients' ESXi hosts were hit by Warp Panda?

First run Get-VMHost | Select-Object Name,Version,Build to find hosts below the fixed builds. Then run the indicator search in step 4 and the vpxuser SSH search in step 5 of the check list against the client's syslog archive since 2025-12-01. Any IP hit means the host is compromised.

Does turning on ESXi audit records fix CVE-2026-41709?

No. Broadcom lists no workaround, so only the fixed build closes the flaw. Remote audit records still matter: CrowdStrike says the group also clears logs, and a copy on the client's syslog server survives that.