CISA adds VMware ESX zero-day to KEV after Warp Panda attacks

CISA added CVE-2026-41709 affecting Broadcom VMware ESX to its Known Exploited Vulnerabilities catalog. CrowdStrike found the flaw was exploited by China-nexus group Warp Panda against the U.S. legal sector to reduce audit trail visibility.

• CISA added CVE-2026-41709 in VMware ESX to the KEV catalog
• The flaw was exploited by China-linked group Warp Panda
• Attacks targeted the U.S. legal sector
• The goal was to reduce audit trail visibility