CISA adds VMware and Linux kernel flaws to exploited list

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-41709, described as an insufficient logging vulnerability in Broadcom VMware ESX, and CVE-2026-46300, a Linux kernel flaw for missing initialization of a variable. The KEV addition follows Broadcom’s July patches that addressed five VMware ESXi-related flaws, including CVE-2026-41709.

CISA notes that exploitation could enable an attacker with administrator privileges to perform actions on affected systems without those actions being logged, thereby hindering incident response, though the flaw does not grant admin rights by itself. The CVSS for CVE-2026-41709 is listed at 7.6.

CISA’s second entry, CVE-2026-46300 (CVSS 2.7), is linked to the Fragnesia flaw in the Linux kernel’s XFRM ESP-in-TCP subsystem, which could permit local users to achieve root access via page cache corruption. Wiz and other researchers described how unprivileged local attackers could modify read-only contents in kernel page cache, enabling deterministic privilege escalation. The vulnerability was identified by William Bowling of the V12 security team, with Wiz publishing technical analysis.

CISA directs federal agencies under BOD 22-01 to remediate these issues by 11 November 2026 for CVE-2026-41709 and by 31 October 2026 for CVE-2026-46300, with advisories urging private organisations to review the KEV catalog and address affected systems.