# CISA Adds Linux Kernel and VMware ESX Flaws to Exploited Catalog Federal agencies must patch critical vulnerabilities to mitigate active exploitation risks in infrastructure. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/90b02d03-6f2d-403b-9d65-82e389ab4a4f ## CISA Expands Exploited Catalog The U.S. Cybersecurity and Infrastructure Security Agency has officially added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog. These include flaws within the Linux Kernel and Broadcom VMWare ESX environments. Federal agencies are now mandated to address these specific security gaps to protect their networks from ongoing, active exploitation attempts. ## VMware ESX Logging Vulnerability CVE-2026-41709, carrying a CVSS score of 7.6, stems from insufficient logging within VMware ESX. While it does not grant initial administrative access, it allows attackers who already possess such privileges to perform operations without leaving audit trails. This mechanism significantly hinders incident response efforts and enables long-term covert activity by malicious actors. ## Threat Actor Warp Panda Tactics The China-linked threat actor Warp Panda, also known as Armory Castle, utilized CVE-2026-41709 as a zero-day in early 2026. By exploiting this flaw, the group successfully reduced visibility into their activities within audit logs. Their broader operational strategy involves targeting internet-facing edge devices, deploying custom malware, and stealing cloud session tokens for persistence. ## Fragnesia Linux Kernel Flaw The second addition, CVE-2026-46300, is a Linux Kernel vulnerability nicknamed Fragnesia. It affects the XFRM ESP-in-TCP subsystem, allowing local attackers to gain full root access through page cache corruption. Security researchers note that this bug is particularly dangerous because it enables unprivileged users to modify read-only files in memory with high reliability. ## Technical Analysis of Fragnesia Discovered by William Bowling of the V12 security team, the flaw allows deterministic page-cache corruption without requiring complex race conditions. Technical reports from Wiz highlight that this vulnerability shares functional similarities with previous escalation bugs like Dirty Frag and Copy Fail. It poses a severe risk to major Linux distributions currently in production. ## Mandatory Remediation Timelines Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must prioritize these fixes. CISA has set a deadline of October 31, 2026, for the Linux Kernel vulnerability, CVE-2026-46300. The VMware ESX flaw, CVE-2026-41709, requires remediation by November 11, 2026, to ensure compliance and maintain network integrity against identified threat vectors. ## Guidance for Private Organizations While the directive specifically targets federal agencies, security experts strongly recommend that private organizations review the CISA catalog. Addressing these vulnerabilities within private infrastructure is essential to mitigate the risk of exploitation by sophisticated groups. Organizations should verify their patch status against these specific CVEs to prevent potential unauthorized access and data exfiltration. ## Strategic Security Implications The inclusion of these flaws underscores the persistent threat posed by zero-day exploits targeting core infrastructure components. By mandating rapid patching, CISA aims to close the window of opportunity for threat actors like Warp Panda. Continuous monitoring and timely updates remain the primary defense against attackers seeking to bypass audit logging and escalation. ## Sources covering this story - https://securityaffairs.com/202050/hacking/u-s-cisa-adds-linux-kernel-and-broadcom-vmware-esx-flaws-to-its-known-exploited-vulnerabilities-catalog.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._