CISA Adds Two Actively Exploited Vulnerabilities (CVE‑2026‑41709, CVE‑2026‑46300) to KEV Catalog
What It Is — The Cybersecurity and Infrastructure Security Agency (CISA) announced that two vulnerabilities have been elevated to its Known Exploited Vulnerabilities (KEV) Catalog.
- CVE‑2026‑41709 – an insufficient‑logging flaw in Broadcom’s VMware ESX hypervisor that can allow an attacker to hide malicious activity after gaining access.
- CVE‑2026‑46300 – a missing‑initialization bug in the Linux kernel that may enable privilege escalation or code execution on affected distributions.
Both CVEs have confirmed evidence of active exploitation in the wild, prompting CISA’s Binding Operational Directive 26‑04 to require federal agencies (and, by recommendation, all organizations) to prioritize rapid remediation of these high‑risk items on any publicly exposed asset.
Affected Products
- Broadcom VMware ESX (hypervisor) – CVE‑2026‑41709
- Linux kernel (various distributions) – CVE‑2026‑46300
Why It Matters for Trust & Control Assurance – The flaws test the logging & monitoring and secure configuration control objectives that sit at the core of the Verisq Common Framework. Demonstrating timely detection, patching, and evidence of remediation directly supports audit‑ready control assurance.
Recommended Actions
- Verify that the latest security patches for ESX (addressing CVE‑2026‑41709) and the affected Linux kernel versions (addressing CVE‑2026‑46300) are applied to all public‑facing systems.
- Enable and review comprehensive logging on ESX hosts to ensure any post‑exploitation activity is captured.
- Record remediation steps in your vulnerability‑management tool to provide defensible evidence for audits and BOD 26‑04 compliance.
- Conduct a rapid risk assessment to confirm no adversary activity occurred before patching.
Source: CISA Advisory – 28 Oct 2026