CISA Flags Two Actively Exploited Vulnerabilities in VMware ESX and Linux Kernel

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities catalog, highlighting ongoing risks in widely used enterprise infrastructure.

Details of the additions

The agency listed CVE-2026-41709, an insufficient logging issue in Broadcom VMware ESX, and CVE-2026-46300, a missing variable initialization flaw in the Linux kernel. Both are confirmed to be under active exploitation in the wild.

VMware ESX environments affected by the logging gap may fail to record critical security events, complicating incident response. The Linux kernel issue stems from uninitialized variables that attackers can leverage for privilege escalation or stability attacks.

Why this matters now

Virtualization platforms and Linux servers form the backbone of most data centers and cloud workloads. Insufficient logging reduces visibility into attacks, while kernel flaws in core operating systems carry broad impact across servers, containers, and embedded devices.

Organizations running VMware ESX or recent Linux distributions should immediately audit their deployments against the CVEs. Where patches are available, apply them without delay. Even without direct exposure, reviewing logging configurations and kernel update policies strengthens overall resilience.

Practical steps for teams

• Inventory all ESX hosts and Linux systems for version exposure.
• Enable enhanced logging where the vulnerability permits.
• Monitor CISA alerts and vendor advisories for follow-on guidance.
• Consider compensating controls such as network segmentation and runtime detection for unpatched systems.

Security teams should treat these additions as a reminder that foundational infrastructure components remain high-value targets. Regular review of the KEV catalog helps prioritize limited patching resources on issues already proven to be exploited.

Sources

• www.cisa.gov

Cover photo by Ann H on Pexels, used under the Pexels License.