CISA adds VMware ESX and Linux kernel flaws to KEV
Original title: U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
CISA added two flaws to its Known Exploited Vulnerabilities catalog. CVE-2026-41709 (CVSS 7.6) is insufficient logging in Broadcom VMware ESX: an attacker who already has administrator privileges can perform operations that are not recorded. CrowdStrike’s 2026 Legal Threat Landscape Report says China-linked Warp Panda used it as a zero-day in early 2026 to hide activity. CVE-2026-46300 (CVSS 2.7), called Fragnesia, is a Linux kernel missing-initialization bug in the XFRM ESP-in-TCP subsystem that Wiz says lets unprivileged local attackers corrupt the page cache and gain root. Under BOD 22-01, federal agencies must meet the stated due dates.
- Broadcom patched CVE-2026-41709 in July among five ESXi, vCenter, Workstation, and Fusion issues.
- The ESX flaw does not grant administrator rights; the attacker must already have them.
- Warp Panda is also called Armory Castle, UNC5221, Clay Typhoon, and VerdantBamboo.
- Wiz says Fragnesia can modify read-only file contents in the kernel page cache.
- William Bowling of the V12 security team discovered CVE-2026-46300.
Impact: Hide admin actions in logs, or local root via page-cache corruption
| Product | Affected | Fixed in |
|---|---|---|
| Broadcom VMware ESX | — | patches released in July |
| Linux kernel | XFRM ESP-in-TCP subsystem | — |
- 1.Federal agencies must remediate CVE-2026-41709 by November 11, 2026.
- 2.Federal agencies must remediate CVE-2026-46300 by October 31, 2026.
- 3.Private organizations should review the KEV catalog and patch both flaws.
- Vendors
- Broadcom
- Threat actors
- Warp Panda
- Organizations
- CISACrowdStrikeWiz
- Countries
- United StatesChina
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Insufficient logging in VMware ESX for admin operations | 2.7 | <1% | KEV | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.