China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

The U.S. CISA added a Broadcom VMware ESX vulnerability (CVE-2026-41709) to its exploited vulnerabilities list after CrowdStrike reported its use by China-linked hackers Warp Panda to evade audit logs in U.S. legal sector attacks. Warp Panda exploits zero-days to maintain covert access, targeting VMware and cloud environments with custom malware.