CISA Adds Linux Kernel and Broadcom VMware ESX Flaws to KEV Catalog, Highlighting Logging Gaps and Local Privilege‑Escalation Risks
What Happened – The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced that two newly disclosed vulnerabilities have been added to its Known Exploited Vulnerabilities (KEV) catalog.
- CVE‑2026‑41709 – A Broadcom‑supplied component in VMware ESX suffers from insufficient logging. An attacker who already possesses administrator privileges can perform actions that are not recorded in the system audit logs, making detection and forensic analysis difficult. The flaw was exploited as a zero‑day by the China‑linked threat group Warp Panda in early 2026.
- CVE‑2026‑46300 – A Linux‑kernel issue (nicknamed “Fragnesia”) stems from a missing variable initialization in the XFRM ESP‑in‑TCP subsystem. A local, low‑privilege attacker can corrupt the page cache and obtain full root access, effectively bypassing normal privilege boundaries.
Both vulnerabilities were publicly disclosed in July 2026, and patches for the VMware issue were released the same month. The Linux‑kernel flaw remains unpatched as of the announcement.
Why It Matters for Trust & Control Assurance – The VMware logging gap directly challenges the control objective of maintaining reliable audit trails, a cornerstone for detection, incident response, and compliance evidence.
Who Is Affected – Cloud‑infrastructure providers, data‑center operators, and any organization running VMware ESX or Linux‑based hypervisors.
Recommended Actions –
- Verify that the July 2026 patches for VMware ESX are applied across all hosts.
- For Linux systems, prioritize a review of kernel versions and apply any forthcoming patches for CVE‑2026‑46300.
- Conduct a control‑mapping exercise to confirm that audit‑logging mechanisms capture all privileged actions; document evidence for audit readiness.
Technical Notes –
- Attack vectors: privileged‑account abuse (VMware) and local privilege escalation (Linux).
- CVSS scores: 7.6 (High) for CVE‑2026‑41709; 2.7 (Low) for CVE‑2026‑46300.
- Public disclosures: Broadcom patch (July 2026); vulnerability research by William Bowling (V12) and Wiz analysis.