Chinese Hackers Turned a VMware Bug Rated 2.7 out of 10 Into a Zero-Day to Erase Their Tracks in US Law Firms

On paper, CVE-2026-41709 barely deserved a second look. The VMware ESXi flaw scores 2.7 out of 10 and only lets someone who is already an admin perform some operations without being logged. For a state-backed espionage crew inside US law firms, that was exactly the point.

CrowdStrike's 2026 Legal Threat Landscape Report says a China-nexus group it calls Warp Panda exploited the bug as a zero-day in early 2026 to reduce audit trail visibility. Victims included US organizations in the legal sector.

The bug needs admin access first, so it never opened a door for anyone. What it offered was quiet: once inside, the attackers could do some of their work without leaving the record defenders rely on to reconstruct an intrusion.

On Wednesday, CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until November 11 to patch. The agency offered no exploitation details.

A crew with a long record

Warp Panda is also tracked as Armory Castle (formerly UNC5221), Clay Typhoon and VerdantBamboo, and has a history of zero-days in Citrix NetScaler and Ivanti Connect Secure. Earlier this month, Mandiant tied the crew to zero-day exploitation of a BeyondTrust Remote Support flaw, CVE-2026-102764, rated 9.3, used to deliver malware called SAWFLY and BARECLAW.

The playbook CrowdStrike describes starts at the network edge, with zero-days against internet-facing devices. From there the group pivots to VMware vCenter and deploys BRICKSTORM and SharpStorm for quiet persistence, alongside TetanusStorm, DualGauge and GuestConduit through 2025.

Then it moves into the cloud. The attackers steal cloud session tokens to get into Microsoft 365 without setting off credential alerts, and in at least one case registered a rogue MFA device so their access would survive a password change.

CrowdStrike says the group "actively circumvents detection by bypassing audit logging, harvesting cloud session tokens, and registering rogue multi-factor authentication (MFA) devices."

Why law firms

Law firms keep drawing attackers of every kind, from state spies to the extortion gang that sent fake IT workers into US firms to copy files by hand. CrowdStrike's explanation for the espionage interest is blunt.

"The legal sector's concentration of client communications, merger and acquisition materials, active litigation strategy, and cross-client access makes it a high-value collection target for a state-directed adversary seeking intelligence with downstream operational utility," the report says.

The rest of the July batch

Broadcom disclosed the flaw on July 29, alongside three critical bugs and one high-severity bug in vCenter, ESXi, Workstation and Fusion. Fixes landed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 and newer, plus VMware Cloud Foundation 5.2.4.

The low-rated logging bug was not the only one from those advisories to be hit in the wild. CVE-2026-59309, a critical authentication bypass, and CVE-2026-59310, a critical directory traversal leading to code execution, were exploited too.

In mid-August, Quirso said an advanced persistent threat group used CVE-2026-59310 to compromise about 360 web-accessible vCenter servers and deploy an SSH reverse shell, later attributing the activity to a China-linked actor. Mass targeting was flagged in early September.

A score of 2.7 measures what a bug can do on its own. It says nothing about what it is worth to someone already inside and trying not to be noticed.

Some offers on this page may be paid placements or contain affiliate links.