CISA adds two CVEs to KEV catalog

CISA added two flaws with evidence of active exploitation to its Known Exploited Vulnerabilities, or KEV, catalog: CVE-2026-41709, an insufficient logging vulnerability in Broadcom VMware ESX, and CVE-2026-46300, a Linux kernel vulnerability tied to an uninitialized variable. The agency also set remediation deadlines for US civilian federal agencies and added response requirements for CVE-2026-41709.

What does CISA require for CVE-2026-41709?

CISA set Nov. 11, 2026, as the remediation deadline for US civilian federal agencies. The official record also links this CVE to mitigation steps based on the vendor’s guidance, an assessment of each asset’s internet exposure, and compliance with BOD 26-04 and forensic triage guidance.

Aviatrix described CVE-2026-41709 as a flaw that lets a malicious actor with administrative privileges perform certain actions in ESX without generating audit log entries. That coverage attributed exploitation to Warp Panda, a China-linked group, and said the flaw was used as a zero-day to reduce the visibility of audit logs. That attribution should be read as reported by Aviatrix, not as independent confirmation.

Rescana, meanwhile, characterized it as a low-severity vulnerability that requires prior administrative access and does not involve unauthenticated code execution. That description fits a control failure that breaks environment traceability, rather than a direct remote compromise.

What is known about CVE-2026-46300?

CISA set Oct. 31, 2026, as the remediation deadline for CVE-2026-46300 in US civilian federal agencies. The KEV entry describes it as a Linux kernel flaw tied to the handling of shared fragments in socket buffers, and says that under specific conditions, ESP input processing can modify data backed by the page cache.

Help Net Security identified it as "Fragnesia" and said it was disclosed in May 2026. That coverage also tied it to the forensic triage requirements under BOD 26-04, in line with how CISA treated it in KEV.

Brandefense added technical context, saying exploitation of CVE-2026-46300 can be chained with PHP2Shell vulnerabilities to reach root-level command execution and deploy PHP web shells. As reported by the source, that relationship should be understood as a technical chaining scenario, not as a universal scope for the vulnerability.

Is there a confirmed regional angle?

There is no confirmed Latin American regional impact in the material reviewed. Available coverage focuses on CISA’s record, remediation deadlines for US federal agencies, and the technical context around active exploitation of both CVEs.