EN PT-BR
← Voltar ao feed
critical exploit público government legal

Warp Panda exploited VMware ESX zero-day CVE-2026-41709 to evade audit logging; CISA adds it and Linux Fragnesia CVE-2026-46300 to KEV

5 fonte(s) · 6 atualização(ões) · publicado 28/10/2026 09:00 · coletado há 3 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 30/10/2026 00:01; os links antigos trazem para cá.

Fontes: securityaffairs.com ↗ gbhackers.com ×2 ↗ securityweek.com ↗ thehackernews.com ↗ cisa.gov ↗

CISA added CVE-2026-41709, an insufficient logging flaw (CWE-778) in Broadcom VMware ESX/ESXi, and CVE-2026-46300, a missing variable initialization flaw in the Linux Kernel known as Fragnesia, to its KEV Catalog on 28 October 2026 (cisa.gov). CrowdStrike attributes zero-day exploitation of CVE-2026-41709 to the China-nexus actor Warp Panda (aka Armory Castle, UNC5221, Clay Typhoon, VerdantBamboo), mainly against the U.S. legal sector. The flaw lets an attacker with administrator access perform operations without them being logged, which reduces audit trail visibility (thehackernews.com, securityweek.com). Exploitation ran from 2025 into early 2026 (securityweek.com), and Broadcom patched the flaw in July 2026. The CISA alert itself gave no attribution or exploitation details; these came from later reporting built on CrowdStrike's 2026 Legal Threat Landscape Report. The remediation deadline is November 11, 2026 for CVE-2026-41709 and October 31, 2026 for CVE-2026-46300 (securityaffairs.com). Sources disagree on the CVSS score for CVE-2026-41709 (see Conflicting Reports).

Entenda a falha

A vulnerabilidade

CVE-2026-41709 is an insufficient logging flaw (CWE-778) in Broadcom VMware ESX/ESXi. An attacker who already has administrator access can perform certain operations without them being logged. It gives no initial access or RCE. CVSS v3.1 is 2.7 per most sources (securityaffairs.com says 7.6). Affected are the ESX 8.0, 9.0 and 9.1 branches, VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform. Fixed in ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, ESXi-9.1.0.0-25370933 and VCF 5.2.4. CVE-2026-46300 (Fragnesia) is a missing variable initialization in the Linux kernel XFRM ESP-in-TCP code. It lets an unprivileged local user modify read-only file contents in the page cache and reach root. The articles give no kernel versions. Both are in CISA KEV.

Como funciona

For CVE-2026-41709, an attacker who controls an administrative account on an ESX host performs certain operations, and the host does not write the audit records it should for them. Later log review shows an incomplete picture, so reconstructing the intrusion or building a timeline is harder. CrowdStrike reports Warp Panda used this after reaching vCenter through internet-facing edge devices. The articles do not say which operations go unlogged. For Fragnesia, a local unprivileged user reaches the kernel's XFRM ESP-in-TCP subsystem, where a variable is left uninitialized. According to Wiz, this allows deterministic corruption of the page cache, changing the in-memory contents of read-only files and gaining root without race conditions. The exact step where the variable is used is not detailed.

Por que é vulnerável

CVE-2026-41709 is classified as CWE-778, Insufficient Logging: some administrative operations are not recorded as security events. MITRE, cited by gbhackers.com, notes such gaps can hide security events and hinder forensics. CVE-2026-46300 is classified by CISA as a missing initialization of a variable in the XFRM ESP-in-TCP code, which is what makes the page-cache corruption possible. Securityaffairs.com compares it to the earlier Linux flaws Dirty Frag and Copy Fail. The articles do not say why either flaw went unnoticed or what the fixes change beyond delivering the fixed ESX builds.

Onde está

Only the XFRM ESP-in-TCP subsystem of the Linux kernel is named for CVE-2026-46300; no file, function or commit is named for either CVE.

Como foi descoberta

Broadcom disclosed CVE-2026-41709 in its July 29, 2026 advisories (CVE published July 30), alongside three critical and one high-severity bug in vCenter, ESXi, Workstation and Fusion. CrowdStrike's 2026 Legal Threat Landscape Report attributes zero-day exploitation to the China-nexus Warp Panda (aka Armory Castle, UNC5221, Clay Typhoon, VerdantBamboo), mainly against US law firms. Sources differ on the window: early 2026 (thehackernews.com, securityaffairs.com) or several attacks through 2025 and into early 2026 (securityweek.com). CISA's alert gives no attribution. Fragnesia was found by William Bowling of the V12 security team, with technical analysis by Wiz. CISA added both to KEV on 28 October 2026, with deadlines of November 11 (CVE-2026-41709) and October 31 (CVE-2026-46300).

Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 00:16.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-46300. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52591 ↗ · local · linux · pub. 29/05/2026 não verificado

    Linux Kernel - Local Privilege Escalation

    This Exploit-DB entry is a write-up, not exploit code. It describes a local privilege escalation chaining three Linux kernel flaws: the xfrm ESP handling with extended sequence numbers, RxRPC in-place decryption, and ESP-in-TCP fragment coalescing. Together they would let an unprivileged local user write into the page cache and alter a setuid binary such as su to get root. It needs local code execution on an affected kernel with these networking features. Maturity is unclear: only a sample console output is shown, the code is linked externally, and it is unverified.

    CVE-2026-46300 · autor: nu11secur1ty · explicação gerada por IA

Detalhes técnicos

  • CVE-2026-41709: CWE-778, published July 30, 2026, disclosed in Broadcom's July 29 advisories alongside three critical and one high-severity bug in vCenter, ESXi, Workstation and Fusion (securityweek.com, gbhackers.com). CVSS v3.1 is 2.7 per most sources: high privileges required, low complexity, no user interaction. It gives no initial access or RCE and is a post-compromise anti-forensics enabler (gbhackers.com). CISA lists ransomware use as unknown.
  • Affected: ESX 8.0, 9.0 and 9.1 branches, plus VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform (gbhackers.com).
  • Warp Panda tradecraft: initial access through internet-facing edge devices, then a pivot to VMware vCenter (thehackernews.com, securityweek.com). The group has a history of zero-days in Citrix NetScaler and Ivanti Connect Secure. It bypasses audit logging, steals cloud session tokens to reach Microsoft 365 without credential-based alerts, and in at least one case registered a rogue MFA device to survive password changes.
  • Malware tied to the group: BRICKSTORM/BrickStorm, SharpStorm, TetanusStorm, DualGauge, GuestConduit. Prior vCenter intrusions also involved JSP web shells, implants on ESXi hosts and guest VMs, log clearing, timestomping and unregistered malicious VMs (gbhackers.com).
  • Mandiant linked the group to a zero-day in BeyondTrust Remote Support (CVE-2026-102764, CVSS 9.3), used to deliver SAWFLY and BARECLAW (thehackernews.com).
  • Related exploitation from the same Broadcom advisories (securityweek.com): CVE-2026-59309 (critical authentication bypass) and CVE-2026-59310 (critical directory traversal leading to code execution). In mid-August Quirso reported an APT using CVE-2026-59310 to compromise about 360 web-accessible vCenter servers and deploy an SSH reverse shell. Quirso later attributed this to a China-linked actor and said CVE-2026-59309 was likely exploited earlier, possibly by a different actor. Mass targeting of CVE-2026-59310 was flagged in early September.
  • CVE-2026-46300 / Fragnesia: a flaw in the XFRM ESP-in-TCP subsystem. It lets unprivileged local attackers corrupt the kernel page cache, modify read-only file contents and reliably escalate to root without race conditions. It was found by William Bowling (V12 security team) and analyzed by Wiz, and is similar to the earlier Dirty Frag and Copy Fail bugs (securityaffairs.com).
  • Broader CrowdStrike report context (gbhackers.com): intrusions against legal entities nearly doubled from the 2023 baseline, and 455 legal organizations were named on extortion leak sites (up 39% YoY). 82% of activity was financially motivated. Other China-nexus operations: TITAN PANDA (hardcoded IIS machine key in Intapp Time Server, April 2026), MURKY PANDA (ORB28 password spraying, 340+ organizations) and OVERCAST PANDA (UK law firm executives, September–October 2025).

Remediação

  • Apply Broadcom fixed builds: ESXi80U3j-25429389 (ESX 8.0 and Telco Cloud Platform), ESXi-9.0.2.0100-25595025 (9.0), ESXi-9.1.0.0-25370933 (9.1) or newer, and VMware Cloud Foundation 5.2.4 (thehackernews.com, gbhackers.com, securityweek.com). Validate deployed builds and do not defer because of the low CVSS score.
  • Update Linux kernels for CVE-2026-46300 (securityaffairs.com).
  • FCEB agencies must meet the KEV due dates: November 11, 2026 (CVE-2026-41709) and October 31, 2026 (CVE-2026-46300). CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV entries. Discontinue use of affected products if mitigations are unavailable (gbhackers.com).
  • Review vCenter and edge device exposure, M365 session token activity and newly registered MFA devices. Monitor vCenter for unregistered VMs, cleared logs and timestomped files, and investigate identity systems (password spraying telemetry) alongside virtualization infrastructure (thehackernews.com, gbhackers.com).

Relatos divergentes

  • CVSS for CVE-2026-41709: 2.7 (thehackernews.com, gbhackers.com), consistent with the "low-severity" description (securityweek.com), versus 7.6 (securityaffairs.com). The 2.7 figure is backed by the detailed vector breakdown and by several sources, so it is more likely correct; the 7.6 figure is unconfirmed.
  • Binding directive: cisa.gov and gbhackers.com cite BOD 26-04; securityaffairs.com cites BOD 22-01. The CISA alert (cisa.gov) is the primary source.
  • Compromise assessment: cisa.gov says agencies must check whether actors compromised systems before patching, while gbhackers.com says the KEV entry states forensic triage is not required for this CVE.
  • Exploitation window and attribution: thehackernews.com and securityaffairs.com say early 2026; securityweek.com says several attacks throughout 2025 and as late as early 2026. An early gbhackers.com article named no actor; later reporting attributes it to Warp Panda on CrowdStrike's findings. The CrowdStrike-based reporting is more recent and more authoritative.
  • Fixed build naming: thehackernews.com gives the 9.1 build as "SXi-9.1.0.0-25370933" under VCF/VVF; the other sources give ESXi-9.1.0.0-25370933.
  • Fix details in the CrowdStrike report: gbhackers.com notes the report itself gives no affected versions, CVSS or fixes, so those come from Broadcom and CISA-related coverage.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 29/10/2026 13:05 · coletado 29/10 15:00

    CISA KEV adds VMware ESX CVE-2026-41709, exploited as zero-day by China-linked Warp Panda, and Linux 'Fragnesia' CVE-2026-46300

    Security Affairs adds attribution and exploitation detail missing from the earlier reporting: CrowdStrike attributes zero-day exploitation of CVE-2026-41709 in early 2026 to China-linked Warp Panda (UNC5221 / Clay Typhoon / Armory Castle / VerdantBamboo), used to hide activity in audit logs. It also names CVE-2026-46300 as 'Fragnesia', an XFRM ESP-in-TCP page-cache corruption bug giving deterministic root, discovered by William Bowling (V12) and analyzed by Wiz, with a KEV deadline of October 31, 2026. It cites BOD 22-01 and a CVSS of 7.6 for CVE-2026-41709, conflicting with the earlier 2.7 figure.

    ler a análise desta fonte

    Security Affairs adds attribution and exploitation detail missing from the earlier reporting: CrowdStrike attributes zero-day exploitation of CVE-2026-41709 in early 2026 to China-linked Warp Panda (UNC5221 / Clay Typhoon / Armory Castle / VerdantBamboo), used to hide activity in audit logs. It also names CVE-2026-46300 as 'Fragnesia', an XFRM ESP-in-TCP page-cache corruption bug giving deterministic root, discovered by William Bowling (V12) and analyzed by Wiz, with a KEV deadline of October 31, 2026. It cites BOD 22-01 and a CVSS of 7.6 for CVE-2026-41709, conflicting with the earlier 2.7 figure.

    CISA added CVE-2026-41709 (Broadcom VMware ESX insufficient logging) and CVE-2026-46300 (Linux Kernel missing variable initialization, aka Fragnesia) to the KEV catalog. Per CrowdStrike's 2026 Legal Threat Landscape Report, the China-linked actor Warp Panda (aka Armory Castle, UNC5221, Clay Typhoon, VerdantBamboo) exploited CVE-2026-41709 as a zero-day in early 2026 to suppress its activity in audit logs. Fragnesia, in the XFRM ESP-in-TCP subsystem, lets unprivileged local attackers corrupt the kernel page cache and deterministically escalate to root. Remediation deadlines are November 11, 2026 for CVE-2026-41709 and October 31, 2026 for CVE-2026-46300.

    Technical Details

    • CVE-2026-41709 (CVSS 7.6 per Security Affairs): an admin-level user can perform operations without them being logged, hampering detection and incident response. Patched by Broadcom in July 2026 alongside four other ESXi/vCenter/Workstation/Fusion flaws.
    • Warp Panda targets internet-facing edge devices with zero-days and custom malware, bypasses audit logging, steals cloud session tokens and registers unauthorized MFA devices.
    • CVE-2026-46300 / Fragnesia: XFRM ESP-in-TCP subsystem flaw allowing modification of read-only file contents in the kernel page cache and reliable root escalation without race conditions. Found by William Bowling (V12 security team); technical analysis by Wiz. Similar to earlier Linux LPE bugs Dirty Frag and Copy Fail.

    Remediation

    • Under BOD 22-01, FCEB agencies must remediate by the stated due dates; private organizations should patch ESX to fixed builds and update Linux kernels.
  2. gbhackers.com ↗ · pub. 29/10/2026 09:30 · coletado 29/10 11:01

    CrowdStrike: WARP PANDA ESXi zero-day CVE-2026-41709 part of broader China-nexus campaign against law firms

    CrowdStrike's 2026 Legal Threat Landscape Report (gbhackers.com) widens the picture around CVE-2026-41709: the flaw is a command-logging bypass that does not by itself grant initial access or RCE, and no affected versions, CVSS or fix details are provided in this report. It adds three further China-nexus operations against legal entities — TITAN PANDA exploiting a hardcoded IIS machine key in Intapp Time Server (April 2026), MURKY PANDA's ORB28 password spraying hitting 340+ organizations, and OVERCAST PANDA targeting UK law firm executives in September–October 2025 — plus statistics showing legal-sector intrusions nearly doubling since 2023 and 455 legal organizations named on extortion leak sites (up 39% YoY), with 82% of activity financially motivated.

    ler a análise desta fonte

    CrowdStrike's 2026 Legal Threat Landscape Report (gbhackers.com) widens the picture around CVE-2026-41709: the flaw is a command-logging bypass that does not by itself grant initial access or RCE, and no affected versions, CVSS or fix details are provided in this report. It adds three further China-nexus operations against legal entities — TITAN PANDA exploiting a hardcoded IIS machine key in Intapp Time Server (April 2026), MURKY PANDA's ORB28 password spraying hitting 340+ organizations, and OVERCAST PANDA targeting UK law firm executives in September–October 2025 — plus statistics showing legal-sector intrusions nearly doubling since 2023 and 455 legal organizations named on extortion leak sites (up 39% YoY), with 82% of activity financially motivated.

    CrowdStrike's 2026 Legal Threat Landscape Report details China-nexus espionage against the legal sector, including WARP PANDA's exploitation of the VMware ESXi zero-day CVE-2026-41709, a command-logging bypass, in intrusions that ran into early 2026. The report covers September 1, 2025 to August 31, 2026, with intrusions against legal entities nearly doubling from the 2023 baseline. Additional China-nexus activity includes TITAN PANDA exploiting a hardcoded IIS machine key flaw in Intapp Time Server in April 2026, MURKY PANDA's ORB28 password-spraying campaign affecting over 340 organizations, and OVERCAST PANDA targeting executives at a U.K. law firm in late 2025. Despite the espionage pressure, financially motivated actors made up 82% of observed activity, with extortion groups naming 455 legal organizations on leak sites (up 39% YoY).

    Technical Details

    • CVE-2026-41709 bypasses ESXi command logging; the findings do not establish it independently provides initial access or RCE, and no affected versions, CVSS or remediation are given in this report.
    • Prior WARP PANDA vCenter intrusions used BRICKSTORM backdoors, JSP web shells and implants on ESXi hosts and guest VMs, with log clearing, timestomping and unregistered malicious VMs.
    • MURKY PANDA ORB28: one firm saw ~500 failed logins against roughly as many accounts from ~300 IPs over 30 days.

    Remediation

    • Investigate identity systems (cloud/M365, password spraying telemetry) alongside virtualization infrastructure.
    • Monitor vCenter for unregistered VMs, cleared logs and timestomped files.
  3. gbhackers.com ↗ · pub. 29/10/2026 05:30 · coletado 29/10 06:00

    CISA adds exploited VMware ESX insufficient logging flaw CVE-2026-41709 to KEV; remediation due Nov 11

    The article adds detail on CVE-2026-41709 that the original alert lacked: CVSS 2.7, CWE-778, a July 30, 2026 CVE publication date, affected ESX 8.0/9.0/9.1 branches and related VMware products, fixed build numbers, the November 11, 2026 deadline, unknown ransomware use, and that forensic triage is not required for this entry.

    ler a análise desta fonte

    The article adds detail on CVE-2026-41709 that the original alert lacked: CVSS 2.7, CWE-778, a July 30, 2026 CVE publication date, affected ESX 8.0/9.0/9.1 branches and related VMware products, fixed build numbers, the November 11, 2026 deadline, unknown ransomware use, and that forensic triage is not required for this entry.

    CISA added CVE-2026-41709, an insufficient logging vulnerability (CWE-778) in Broadcom VMware ESX, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October 2026 after evidence of exploitation in the wild. The flaw has a low CVSS v3.1 score of 2.7, but it lets an attacker with administrative privileges perform certain operations without leaving log records, reducing visibility and hindering forensics. The catalog sets a remediation deadline of November 11, 2026 and lists ransomware use as unknown. The flaw gives no initial access or privilege escalation by itself, so it is a post-compromise anti-forensics enabler.

    Technical Details

    • CVE record published July 30, 2026; CVSS v3.1 base score 2.7 (high privileges required, low attack complexity, no user interaction).
    • Weakness: CWE-778 Insufficient Logging.
    • Affected: ESX 8.0, 9.0 and 9.1 branches, plus VMware Cloud Foundation, vSphere Foundation and Telco Cloud Platform.
    • Fixed builds: ESXi80U3j-25429389 (8.0), ESXi-9.0.2.0100-25595025 (9.0), ESXi-9.1.0.0-25370933 (9.1).
    • The article names no threat actor, victims or exploitation method. Earlier ESXi ransomware reporting concerns a separate vulnerability.

    Remediation

    • Apply vendor mitigations and validate deployed builds against the fixed versions; do not defer because of the low CVSS score.
    • Follow BOD 26-04 risk prioritization, assess each asset's internet exposure and follow applicable cloud service guidance.
    • Discontinue use of affected products if mitigations are unavailable.
    • The KEV entry states forensic triage is not required under BOD 26-04 for this CVE.
  4. securityweek.com ↗ · pub. 29/10/2026 05:01 · coletado 29/10 06:00

    Warp Panda used low-severity VMware ESXi logging flaw CVE-2026-41709 as zero-day; CISA adds it to KEV

    The article adds that Warp Panda used CVE-2026-41709 in several attacks throughout 2025 and as late as early 2026. It lists more malware (TetanusStorm, DualGauge, GuestConduit). It also ties the wider July 29 Broadcom advisories to exploitation of CVE-2026-59309 and CVE-2026-59310, including Quirso's report of about 360 compromised vCenter servers and mass targeting from early September.

    ler a análise desta fonte

    The article adds that Warp Panda used CVE-2026-41709 in several attacks throughout 2025 and as late as early 2026. It lists more malware (TetanusStorm, DualGauge, GuestConduit). It also ties the wider July 29 Broadcom advisories to exploitation of CVE-2026-59309 and CVE-2026-59310, including Quirso's report of about 360 compromised vCenter servers and mass targeting from early September.

    CISA added CVE-2026-41709, a low-severity insufficient logging flaw in VMware ESXi, to its KEV catalog and gave federal agencies two weeks to patch. CrowdStrike reported that the China-nexus actor Warp Panda exploited it as a zero-day in intrusions at US organizations, including law firms. The flaw lets an attacker logged in as an administrator perform operations without them being logged. Warp Panda used it to significantly reduce audit trail visibility, in several attacks as late as early 2026. It is one of several flaws in Broadcom's July 29 advisories that have been exploited in the wild.

    Technical Details

    • CVE-2026-41709 was disclosed on July 29 alongside three critical and one high-severity bug in VMware vCenter, ESXi, Workstation and Fusion.
    • Warp Panda typically gains initial access through internet-facing edge devices and pivots to VMware vCenter. In 2025 intrusions it deployed BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit.
    • Two other flaws from the same advisories are also exploited: CVE-2026-59309 (critical authentication bypass) and CVE-2026-59310 (critical directory traversal leading to arbitrary code execution).
    • In mid-August, Quirso said an APT exploited CVE-2026-59310 to compromise about 360 web-accessible vCenter servers and deploy an SSH reverse shell. Quirso later attributed the activity to a China-linked actor and said CVE-2026-59309 had likely been exploited earlier, possibly by a different actor. Mass targeting of CVE-2026-59310 was flagged in early September.

    Remediation

    • Apply the patched releases: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 and newer.
    • Federal agencies must patch within two weeks of the KEV addition.
  5. thehackernews.com ↗ · pub. 29/10/2026 03:22 · coletado 29/10 05:00

    China-nexus Warp Panda exploited VMware ESX zero-day CVE-2026-41709 to evade audit logging in attacks on US legal sector

    ler a análise desta fonte

    CISA added CVE-2026-41709, an insufficient logging flaw in Broadcom VMware ESX, to its KEV catalog after CrowdStrike reported that China-nexus actor Warp Panda exploited it as a zero-day in early 2026 against the U.S. legal sector. The flaw lets an actor with admin access perform operations without them being logged, which reduces audit trail visibility. Warp Panda (also tracked as Armory Castle, formerly UNC5221, Clay Typhoon and VerdantBamboo) has a history of zero-day exploitation of Citrix NetScaler and Ivanti Connect Secure. Mandiant also recently attributed zero-day exploitation of a BeyondTrust Remote Support flaw to the group. CISA set a deadline of November 11, 2026 for FCEB agencies to apply the fixes.

    Technical Details

    • CVE-2026-41709 (CVSS 2.7) is an insufficient logging vulnerability in VMware ESX. Broadcom published fixes in July 2026.
    • Warp Panda gains initial access by exploiting internet-facing edge devices, then pivots to VMware vCenter environments and deploys the custom malware BRICKSTORM and SharpStorm for persistence.
    • The group bypasses audit logging, harvests cloud session tokens to access Microsoft 365 without triggering credential-based alerts, and in at least one case registered a rogue MFA device so access survives a password change.
    • Mandiant linked the group to zero-day exploitation of BeyondTrust Remote Support (CVE-2026-102764, CVSS 9.3), used to deliver SAWFLY and BARECLAW.
    • CrowdStrike says the legal sector is a high-value target because of client communications, M&A materials and litigation strategy.

    Remediation

    • Apply the Broadcom fixed builds: VCF/VVF SXi-9.1.0.0-25370933 and ESXi-9.0.2.0100-25595025; ESXi80U3j-25429389 (ESX 8.0 and Telco Cloud Platform); VMware Cloud Foundation 5.2.4.
    • FCEB agencies must patch by November 11, 2026.
    • Review vCenter and edge device exposure, M365 session token activity and newly registered MFA devices.
  6. cisa.gov ↗ · pub. 28/10/2026 09:00 · coletado 28/10 18:00 primeiro registro

    CISA adds exploited VMware ESX CVE-2026-41709 and Linux Kernel CVE-2026-46300 to KEV Catalog

    ler a análise desta fonte

    CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 28 October 2026, citing evidence of active exploitation. They are CVE-2026-41709, an insufficient logging flaw in Broadcom VMware ESX, and CVE-2026-46300, a missing variable initialization flaw in the Linux Kernel. The alert gives no exploitation details, attribution, victims or CVSS scores. CISA stresses that such vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

    Technical Details

    • CVE-2026-41709: Broadcom VMware ESX, insufficient logging.
    • CVE-2026-46300: Linux Kernel, missing initialization of a variable.
    • No affected versions, IOCs, exploitation methods or threat actors are provided in the alert.

    Remediation

    • Under BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation. Agencies must also check whether threat actors compromised the system before the patch was applied.
    • CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.