China-nexus
Security incidents tagged China-nexus. Newest first.
1 China-nexus incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 92
- Longest quiet run: 90 days (Jul 30–Oct 27)
Show 1 older incident1 older incident
July 2026 1
- Patched
VMware ESX logging bypass (CVE-2026-41709) added to CISA KEV: admins can act without being logged
CISA added CVE-2026-41709, a VMware ESX insufficient logging vulnerability, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. Broadcom rates it Low (CVSSv3 2.7): a malicious administrator could perform certain operations on ESX without them being logged, which helps an attacker who already has admin access hide activity. Broadcom fixed it in VMSA-2026-0006, first published July 29 2026, and credits Ian Barton of CrowdStrike for reporting it. CrowdStrike's 2026 Legal Threat Landscape Report (Oct 28) says the China-nexus adversary WARP PANDA exploited CVE-2026-41709 as a zero-day in several intrusions, as late as early 2026, while deploying malware in VMware vCenter environments at U.S. entities including legal-sector targets.
VMware ESX / ESXi (also in VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform)Since Jul 29, 2026
