CISA added CVE-2026-41709 — a low-severity (CVSS 2.7) insufficient-logging flaw in Broadcom VMware ESX, disclosed and patched in July 2026 — to its Known Exploited Vulnerabilities catalogue on 28 October, after CrowdStrike's 2026 Legal Threat Landscape Report revealed the China-nexus actor Warp Panda had exploited it as a zero-day in intrusions at US organisations, including law firms, as late as early 2026. The flaw lets an actor with admin access perform operations without them being logged, directly reducing audit-trail visibility during intrusions. CrowdStrike describes Warp Panda as moving from internet-facing edge devices into vCenter environments, deploying custom malware including BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit, and registering rogue MFA devices. Federal Civilian Executive Branch agencies are directed to apply fixes by 11 November. The legal sector's exposure to M&A, litigation strategy and cross-client access makes it a high-value intelligence target.

• Source article