A low CVSS score can hide a bug that matters a lot. CVE-2026-41709 in VMware ESX scores only 2.7, yet a China-linked group used it as a zero-day, and CISA has put it in the Known Exploited Vulnerabilities (KEV) catalog. If you run ESX hosts and have not patched, this is worth doing this week.

This is a rewrite of our original post on the Warp Panda ESX zero-day , with the steps arranged as a checklist.

What the bug does

CVE-2026-41709 is an insufficient logging flaw. Someone who already has admin access to an ESX host can run certain operations that never show up in the logs.

It does not get an attacker in. It helps them stay unnoticed after they are in, and it leaves you with fewer records to investigate.

Who used it

CrowdStrike says the group Warp Panda exploited it as a zero-day in early 2026, mainly against the U.S. legal sector. The aim was to reduce what defenders could see in audit trails.…