CISA adds Linux Kernel and VMware ESX flaws to KEV catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-41709 in Broadcom VMware ESX (CVSS 7.6) and CVE-2026-46300 in the Linux kernel (CVSS 2.7). The VMware flaw was exploited as a zero-day by the China-linked Warp Panda group, while the Linux bug lets local attackers gain root via page cache corruption. Federal agencies must patch them by November 11 and October 31, 2026.

• CVE-2026-41709 in VMware ESX: insufficient logging, CVSS 7.6
• CVE-2026-46300 (Fragnesia) gives root via kernel page cache
• Warp Panda exploited the VMware flaw as a zero-day in early 2026
• FCEB deadlines: November 11 and October 31, 2026