CISA Adds VMware ESXi and Linux Kernel Vulnerabilities to KEV Catalog
CISA has added two actively exploited vulnerabilities, one in Broadcom VMware ESXi and another in the Linux Kernel, to its Known Exploited Vulnerabilities (KEV) Catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of two new vulnerabilities to its catalog of Known Exploited Vulnerabilities (KEV). The vulnerabilities, identified as CVE-2026-41709 and CVE-2026-46300, are now listed due to evidence of active exploitation in the wild, posing significant risks to organizations.
CVE-2026-41709 is an insufficient logging vulnerability affecting Broadcom's VMware ESXi hypervisor. Insufficient logging can hinder incident response and forensic investigations by failing to record critical security events, potentially allowing attackers to operate undetected for longer periods. This weakness can be exploited to obscure malicious activities within virtualized environments.
The second vulnerability, CVE-2026-46300, resides in the Linux Kernel and is characterized as a missing initialization of a variable. This type of flaw can lead to unpredictable program behavior, including potential crashes or the exposure of sensitive memory contents, which could be leveraged by attackers to gain elevated privileges or execute arbitrary code.
These additions underscore CISA's commitment to identifying and publicizing vulnerabilities that are actively being targeted by malicious actors. The KEV Catalog serves as a critical resource for organizations, particularly federal agencies, to prioritize their vulnerability management efforts. By highlighting these specific CVEs, CISA aims to drive timely remediation and reduce the attack surface.
Federal Civilian Executive Branch (FCEB) agencies are mandated by Binding Operational Directive (BOD) 26-04 to prioritize the patching of vulnerabilities listed in the KEV Catalog, especially those on publicly exposed assets that offer complete control post-exploitation. This directive reinforces the need for a risk-based approach to cybersecurity, ensuring that the most critical threats are addressed promptly.
While BOD 26-04 specifically targets FCEB agencies, CISA strongly encourages all organizations, regardless of sector, to adopt similar risk-based vulnerability management practices. Prioritizing the remediation of vulnerabilities present in the KEV Catalog is a crucial step in enhancing overall cybersecurity posture and defending against widespread cyber threats.
CISA continues to monitor the threat landscape and will add new vulnerabilities to the KEV Catalog as they are identified and confirmed to be under active exploitation. Organizations can also submit potential KEV candidates through CISA's KEV Nomination Form if they possess a CVE ID, evidence of exploitation, and clear mitigation guidance.