Government Advisory

CISA Flags Actively Exploited Flaws in VMware ESX and the Linux Kernel

CISA · 28 Oct 2026

Key Takeaway If your business runs VMware ESX or Linux systems, check the vendor advisories for these two CVEs and prioritise patching, starting with anything exposed to the internet.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence that attackers are already using them. The first is CVE-2026-41709, an insufficient logging vulnerability in Broadcom VMware ESX. The second is CVE-2026-46300, a missing variable initialisation vulnerability in the Linux kernel.

CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors. Its Binding Operational Directive 26-04 requires US federal agencies to prioritise fast fixes for KEV-listed flaws on publicly exposed assets that give an attacker total control once exploited. It also sets expectations for checking whether a system was compromised before a patch was applied.

The directive applies only to US federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and prioritise fixing KEV Catalog vulnerabilities. The summary does not give further technical detail or patch information, so check the vendor advisories for affected versions and fixes.

CISA KEV VMware ESX Linux kernel Patch management Active exploitation

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.