CISA adds VMware ESX and Linux kernel flaws to KEV
Original title: CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2026-41709 and CVE-2026-46300 are actively exploited; BOD 26-04 requires FCEB agencies to prioritize them.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. They are CVE-2026-41709, a Broadcom VMware ESX insufficient logging flaw, and CVE-2026-46300, a Linux kernel missing-initialization flaw. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize high-risk KEV entries on publicly exposed assets and to check for compromise before patching. CISA encourages other organizations to remediate KEV entries using the same risk-based approach.
Unconfirmed: This alert does not give remediation deadlines or describe the exploitation.
- BOD 26-04 applies only to FCEB agencies.
- The directive focuses on flaws that grant total control after exploitation.
- KEV nominations need a CVE ID, exploitation evidence and clear mitigation guidance.
Impact: Actively exploited VMware logging and Linux kernel flaws
| Product | Affected |
|---|---|
| Broadcom VMware ESX | — |
| Linux Kernel | — |
- 1.Prioritize remediation of CVE-2026-41709 and CVE-2026-46300 under BOD 26-04.
- 2.Check whether threat actors compromised systems before the patch was applied.
- Vendors
- Broadcom
- Products
- VMware ESXLinux Kernel
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.