CISA added Linux kernel and Broadcom VMware ESX vulnerabilities to its Known Exploited Vulnerabilities catalog on October 28, 2026, citing evidence of active exploitation. The flaws serve different purposes: the Linux issue can let a local attacker gain root privileges, while the VMware flaw lets someone who already has administrator privileges perform certain operations without those actions appearing in logs.
The agency’s announcement identifies them as CVE-2026-46300, a Linux kernel missing-initialization vulnerability, and CVE-2026-41709, an insufficient-logging vulnerability in VMware ESX.
Different prerequisites and consequences
CVE-2026-46300, also known as Fragnesia, affects the Linux kernel’s XFRM ESP-in-TCP subsystem. According to Security Affairs, which cites technical analysis by Wiz, an unprivileged local attacker can modify read-only file contents in the kernel page cache—the memory holding cached file data—and use that corruption to gain root privileges.
The report credits William Bowling of the V12 security team with discovering the vulnerability. It describes exploitation as deterministic, without requiring race conditions or complicated timing attacks. The prerequisite is local access; this is a privilege-escalation flaw.
For CVE-2026-41709, the attacker must already hold administrator privileges. Security Affairs reports that the logging weakness can conceal specific operations, reducing the evidence available to defenders investigating suspicious activity. It does not itself provide administrator access.
Security Affairs also cites CrowdStrike’s 2026 Legal Threat Landscape Report as saying that the China-linked actor Warp Panda exploited the VMware flaw as a zero-day in early 2026 to reduce visibility in audit logs. That exploitation predates the October catalog addition.
The article lists CVSS scores of 7.6 for the VMware flaw and 2.7 for the Linux flaw. Those severity scores are separate from CISA’s finding that both vulnerabilities have been actively exploited.
Remediation and federal requirements
Security Affairs reports that Broadcom released patches addressing CVE-2026-41709 in July. It gives remediation deadlines of November 11, 2026, for the VMware flaw and October 31, 2026, for the Linux flaw for Federal Civilian Executive Branch agencies.
CISA’s announcement identifies BOD 26-04 as the applicable vulnerability-management directive. It requires covered agencies to prioritize rapid remediation of high-risk KEV vulnerabilities on publicly exposed assets that grant total control after exploitation, and establishes expectations for checking whether systems were compromised before patching.
Those federal requirements apply to covered agencies. CISA separately encourages all organizations to prioritize KEV vulnerabilities through risk-based vulnerability management.
