We Said the 2.7 Was the One to Worry About on July 30. CISA Put It on the Must-Patch List October 28 After a China-Nexus Group Used It as a Zero-Day to Hide From ESXi Logs.
If you deferred the lowest-scoring bug in Broadcom's July advisory, go back and patch it. CVE-2026-41709, an insufficient-logging flaw in VMware ESX, was added to CISA's Known Exploited Vulnerabilities catalog on October 28 with a federal due date of November 11. CrowdStrike says a China-nexus group used it as a zero-day in early 2026 to reduce the audit trail an investigator would have.
Broadcom rated it 2.7, the bottom of VMSA-2026-0006, which covered five vulnerabilities. On July 30 we published Broadcom Shipped Two 9.8s in vCenter With No Workaround. The Bug That Should Worry You Scores 2.7. Our argument was that a logging flaw damages none of confidentiality, integrity or availability on the severity scale, so every triage process that sorts by score defers it, and that it deserves more weight because it undermines the records every later investigation depends on. That was an argument from the advisory text. We did not see exploitation, and we did not know anyone was exploiting it.
What CrowdStrike reported
According to The Hacker News coverage of CrowdStrike's report, the actor it calls Warp Panda exploited CVE-2026-41709 as a zero-day in early 2026, in attacks on the U.S. legal sector. The aim was to reduce audit trail visibility. CrowdStrike describes the group as one that exploits internet-facing edge devices using zero-days and custom malware, bypasses audit logging, harvests cloud session tokens and registers rogue multi-factor authentication devices.
The reported sequence:
- Initial access through an internet-facing edge device.
- A pivot to VMware vCenter, where the actor deploys custom malware including BRICKSTORM and SharpStorm.
- In some intrusions, theft of cloud session tokens to reach Microsoft 365 without credential-based alerts.
- In at least one case, a new MFA device registered on a compromised account, so access survives a password change.
Broadcom's bug needs administrator access on the ESXi host, so it is a step taken after the attacker already has privilege, not a way in. Its job in this chain is to make what happens next harder to find.
What to do
Patch ESX. As listed in the Hacker News piece, the fixed builds are ESXi-9.0.2.0100-25595025 and 9.1.0.0-25370933 for VMware Cloud Foundation and vSphere Foundation. We do not know the fixed builds for older lines, so take them from Broadcom's advisory, which CISA's entry links as support content 38017. The federal due date is November 11.
Then hunt, and do it from records that do not live on the ESXi host.
- Check vCenter and any forwarded syslog for administrative activity on ESXi hosts that has no matching record on the host. A gap is the signal here, since the bug is about missing entries.
- Review multi-factor authentication device registrations on privileged and legal-sector accounts for devices you did not enrol.
- Look for session-token use from addresses and clients that do not match the account's normal pattern, especially for Microsoft 365.
- Hunt the named malware. BRICKSTORM and SharpStorm are the two families CrowdStrike names for the vCenter stage. We have no hashes for SharpStorm. Use the vendors' own reports.
The first item is our recommendation and not CrowdStrike's. An absent log is not evidence that nothing happened. If the host log is the only place you would look, this bug was built to leave you with nothing.
Who this is
The Hacker News lists the actor's other names as Armory Castle, formerly UNC5221, Clay Typhoon and VerdantBamboo, and says it has a history of zero-day attacks on Citrix NetScaler and Ivanti Connect Secure. We already hold a VerdantBamboo profile, imported in June from Volexity's reporting, which describes a BSD build of BRICKSTORM. Whether every one of those names is the same operator is the reporting's claim, and different vendors cluster activity differently. We have not reconciled them, and our June profile does not mention this CVE.
What we hold, and what we don't
We hold the July 30 post and the VerdantBamboo actor profile. We hold no indicators for this campaign, because the coverage we read names no addresses or hashes, so there was nothing to ingest. We had no sighting of this activity, and an actor who attacks a legal firm's ESXi host through an edge device is not one our edge would see. Our earlier post is an analysis dated July 30, and it is not detection.
Limits
This rests on The Hacker News coverage of CrowdStrike's report, the CISA KEV entry and our own July 30 post. We did not read CrowdStrike's report or Broadcom's advisory directly. The fixed build numbers are as printed in the Hacker News article. The attribution of one set of names to one actor is reported, not verified by us.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.