Threat reportVulnerabilityTL-2026-4669
CISA adds two KEVs: Broadcom VMware ESX CVE-2026-41709 (Insufficient Logging) and Linux Kernel CVE-2026-46300 (Fragnesia ESP-in-TCP page-cache LPE)
CISA adds two KEVs (TL-2026-4669), also tracked as Fragnesia, is a critical-severity software vulnerability scored CVSS 7.8, first published 2026-10-28. It has no confirmed attribution, affects Broadcom VMware ESX / ESXi (also vCenter, Workstation, Fusion, Cloud, references 2 CVEs (CVE-2026-41709, CVE-2026-46300), maps to 6 MITRE ATT&CK techniques (T1059.004, T1078, T1106), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 7.8/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4669
- Threat ID
- TL-2026-4669
- Also known as
- Fragnesia, VMSA-2026-0006
- Severity
- CRITICAL
- CVSS
- 7.8
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 6
Malware and tooling in CISA adds two KEVs
Malware and tooling: Fragnesia
How CISA adds two KEVs works
On 2026-10-28 CISA added CVE-2026-41709 (VMware ESX insufficient logging, CVSS 2.7) and CVE-2026-46300 (Linux kernel 'Fragnesia' skb shared-frag marker loss enabling local root via page-cache overwrite, CVSS ~7.8) to the KEV Catalog based on evidence of active exploitation. CISA's alert does not name actors, campaigns or IOCs.
CISA's 2026-10-28 alert adds two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog under BOD 26-04: Broadcom VMware ESX CVE-2026-41709 (Insufficient Logging) and Linux Kernel CVE-2026-46300 (Missing Initialization of a Variable). The alert states that such vulnerabilities are a frequent attack vector for malicious cyber actors, but it gives no attribution, campaign details, IOCs or due date. The two flaws are unrelated to each other and are tracked together only because they were added in the same KEV batch.
CVE-2026-41709 is a CWE-778 insufficient logging flaw in VMware ESX, published 2026-07-29 in Broadcom advisory VMSA-2026-0006 (last updated 2026-08-19). Broadcom states that a malicious administrator could exploit it to perform certain operations without them being logged. Broadcom rates it Low (maximum CVSSv3 base score 2.7) and lists no workarounds. Affected products include VMware ESX/ESXi, vCenter, Workstation, Fusion, Cloud Foundation, vSphere Foundation and Telco Cloud. The same advisory covers more severe flaws (vCenter CVE-2026-59309 and CVE-2026-59310, both 9.8; VMXNET3 out-of-bounds write CVE-2026-47876, 9.3; CVE-2026-41703). Third-party reporting says CVE-2026-59309/59310 were exploited in the wild, but the sources do not tie CVE-2026-41709 to a specific exploitation campaign. The defensive significance is audit-trail evasion: an actor with ESX administrative access may be able to act without leaving log evidence, which weakens detection and forensics on hypervisors.
CVE-2026-46300, nicknamed 'Fragnesia', is a Linux kernel networking flaw disclosed 2026-05-13 by William Bowling of V12 Security (public GitHub PoC, no embargo). skb_try_coalesce() moves paged fragments between sk_buffs but drops the SKBFL_SHARED_FRAG marker. The XFRM ESP-in-TCP input path then skips skb_cow_data() and performs in-place AES-GCM decryption over page-cache-backed pages. The keystream XOR gives a controlled write into cached file pages (a 192-byte XOR primitive via AES-GCM keystream per Tenable). The public PoC overwrites the cached copy of /usr/bin/su with a small position-independent ELF payload to get a root shell. No race condition is required. An unprivileged local user obtains CAP_NET_ADMIN through user and network namespaces, which are enabled by default on most distributions. NVD/CWE data lists CWE-456 and CWE-123, and the CVSS is reported as 7.8. The flaw bypasses the fixes for the 'Dirty Frag' bugs (CVE-2026-43284, CVE-2026-43500); the upstream fix cites the Dirty Frag fix commit f4c50a4034e6. Fixed stable kernels: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1+. Tenable reported no in-the-wild exploitation at publication in May; the October KEV listing is the evidence of later exploitation. Amazon Linux is reportedly unaffected (no espintcp module).
Neither source identifies the exploiting actors, victims or infrastructure, so no network IOCs, attribution or sectors are asserted.
MITRE ATT&CK techniques used in TL-2026-4669
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API
Initial Access
Privilege Escalation
T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
Impact
T1565.001 Data Manipulation: Stored Data Manipulation
defense-impairment
Affected products and versions in CISA adds two KEVs
- Broadcom — VMware ESX / ESXi (also vCenter, Workstation, Fusion, Cloud Foundation, vSphere Foundation, Telco Cloud)
Vulnerable versions: Versions prior to the VMSA-2026-0006 fixed builds
Fixed in: ESX 9.1: ESXi-9.1.0.0200-25557999; Workstation/Fusion 26H1 - Linux — Linux Kernel
Vulnerable versions: 3.9 through 7.0 before fixes; 5.10.x < 5.10.257; 5.15.x < 5.15.208; 6.1.x < 6.1.174; 6.6.x < 6.6.141; 6.12.x < 6.12.91; 6.18.x < 6.18.33; 7.0.x < 7.0.10
Fixed in: 5.10.257; 5.15.208; 6.1.174; 6.6.141; 6.12.91; 6.18.33; 7.0.10; 7.1+
Remediation for CISA adds two KEVs
Patches
- Linux kernel fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1+ (or the distribution backport)
- Broadcom VMSA-2026-0006: e.g. ESX 9.1 ESXi-9.1.0.0200-25557999; see advisory for other branches
Immediate actions
- Prioritize patching both CVEs per CISA KEV / BOD 26-04 guidance
- Linux: unload and blacklist esp4, esp6 and rxrpc (rmmod esp4 esp6 rxrpc; persist via /etc/modprobe.d/) where IPsec ESP is not needed
- Linux: set user.max_user_namespaces=0 on systems that do not need unprivileged user namespaces (RHEL-family guidance)
- Linux: flush page cache (echo 3 > /proc/sys/vm/drop_caches) and verify integrity of setuid binaries such as /usr/bin/su on potentially exposed hosts
- ESX: forward ESXi and vCenter logs to an external SIEM and review administrator account activity, since CVE-2026-41709 can allow operations to go unlogged
Workarounds
- VMSA-2026-0006 lists no workarounds for CVE-2026-41709
- Linux: module blacklisting and disabling unprivileged user namespaces as described above
Longer-term hardening
- Restrict and audit ESX administrative access; enforce MFA and least privilege on vCenter and ESXi
- Monitor setuid binary integrity and page-cache tampering with FIM/EDR
- Apply kernel updates promptly from the distribution vendor
CVEs associated with CISA adds two KEVs
Weaknesses (CWE) in CISA adds two KEVs
Timeline of CISA adds two KEVs
- William Bowling (V12 Security) publicly discloses Fragnesia with a GitHub PoC and no embargo; CVE-2026-46300 is reserved the same day
- Tenable and TuxCare report that Ubuntu, RHEL, Debian, openSUSE, CentOS Stream and others are vulnerable and that Dirty Frag patches do not fix Fragnesia; no in-the-wild exploitation reported at that time
- CVE-2026-46300 published with upstream kernel fix 'net: skbuff: preserve shared-frag marker during coalescing' backported to stable branches
- Broadcom publishes VMSA-2026-0006 covering CVE-2026-41709 (ESX insufficient logging, CVSS 2.7) and other VMware vulnerabilities
- Defused Cyber reports initial probing of other VMSA-2026-0006 flaws (vCenter CVE-2026-59309/59310); not attributed to CVE-2026-41709
- VMSA-2026-0006 last updated by Broadcom
- CISA adds CVE-2026-41709 and CVE-2026-46300 to the KEV Catalog based on evidence of active exploitation
Sources cited for CISA adds two KEVs
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- CVE-2026-41709 CVE Record
- CVE-2026-46300 CVE Record
- Broadcom VMSA-2026-0006 Security Advisory
- Tenable: CVE-2026-46300 (Fragnesia) FAQ
- TuxCare: Fragnesia (CVE-2026-46300) bypasses the Dirty Frag patch
- V12 Security Fragnesia PoC
- Greenbone: Patch now - actively exploited VMware vCenter CVEs (VMSA-2026-0006)
Detection coverage for TL-2026-4669
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4669 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.