Exploited VMware ESX and Linux Kernel Flaws Land on KEV Catalog

En bref

• Two flaws, CVE-2026-41709 and CVE-2026-46300, affect VMware ESX and Linux kernel deployments.
• Threat actors are already exploiting both vulnerabilities in real-world attacks.
• The flaws were placed on the Known Exploited Vulnerabilities catalog on October 28, 2026.
• Federal agencies face elevated enterprise risk, with possible complete control of compromised assets.
• Rapid patching and compensating controls are needed now.

On October 28, 2026, a pair of security defects — CVE-2026-41709 and CVE-2026-46300 — were placed on the Known Exploited Vulnerabilities catalog after evidence showed them being used in real attacks. The affected products are VMware ESX and the Linux kernel, software that sits at the foundation of many virtualized and server environments.

Because these components operate with high privilege, a successful compromise can expose far more than a single workload. The catalog entry signals confirmed exploitation, not a theoretical flaw. Federal departments and agencies are specifically called out as facing elevated enterprise risk, and any organization running the same technology should treat the issue with similar urgency.

The most serious outcome is possible complete control of affected assets. For VMware ESX, that can mean control over the hypervisor and the virtual machines beneath it; for Linux kernel flaws, attackers may gain deep access to the host. Threat actors with malicious intent are already using the vulnerabilities, so exposure windows should be measured in hours, not weeks.

Public-sector networks, including education and local government systems that depend on virtualization and Linux, should review their inventories first. The KEV listing is a prioritization signal: it tells defenders that exploitation is occurring and that remediation should outrank routine patching. Watch for vendor updates from Broadcom, VMware and Linux maintainers, and monitor for follow-on activity such as new accounts, altered configurations or unusual management-plane access.

Defenders should also prepare for the possibility that patching alone will not close the exposure immediately. Compensating controls, tighter access to management interfaces and focused hunting on ESX and Linux hosts are essential while updates are staged. The key question to watch is whether exploitation spreads beyond early targets and whether additional products are implicated.

À faire maintenant

1. Inventory every VMware ESX and Linux kernel asset, including hypervisors, appliances and management endpoints, and record exact versions.
2. Apply vendor updates for both CVEs as an emergency change as soon as fixes are available; do not wait for the next maintenance window.
3. Until patching is complete, remove hypervisor and Linux management interfaces from direct internet exposure and restrict them to trusted administrative networks.
4. Hunt for exploitation evidence on ESX and Linux hosts: unexpected processes, new local accounts, modified startup items, unusual outbound connections and configuration changes.
5. Enforce least privilege and strong authentication for virtualization management, and rotate credentials for accounts that may have been exposed.
6. Review logs and alerting for lateral movement from compromised hosts, and isolate affected systems immediately if suspicious activity is confirmed.

Références CVE

• CVE-2026-41709
• CVE-2026-46300

Source originale

CISA Advisories