# CISA adds two KEVs: Broadcom VMware ESX CVE-2026-41709 (Insufficient Logging) and Linux Kernel CVE-2026-46300 (Fragnesia ESP-in-TCP page-cache LPE)

> On 2026-10-28 CISA added CVE-2026-41709 (VMware ESX insufficient logging, CVSS 2.7) and CVE-2026-46300 (Linux kernel 'Fragnesia' skb shared-frag marker loss enabling local root via page-cache overwrite, CVSS ~7.8) to the KEV Catalog based on evidence of active exploitation. CISA's alert does not name actors, campaigns or IOCs.

- **Published:** 2026-10-28T20:22:05Z
- **Last reviewed:** 2026-10-28T20:22:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4669
- **ID:** TL-2026-4669
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41709, CVE-2026-46300

## Description

CISA's 2026-10-28 alert adds two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog under BOD 26-04: Broadcom VMware ESX CVE-2026-41709 (Insufficient Logging) and Linux Kernel CVE-2026-46300 (Missing Initialization of a Variable). The alert states that such vulnerabilities are a frequent attack vector for malicious cyber actors, but it gives no attribution, campaign details, IOCs or due date. The two flaws are unrelated to each other and are tracked together only because they were added in the same KEV batch.

CVE-2026-41709 is a CWE-778 insufficient logging flaw in VMware ESX, published 2026-07-29 in Broadcom advisory VMSA-2026-0006 (last updated 2026-08-19). Broadcom states that a malicious administrator could exploit it to perform certain operations without them being logged. Broadcom rates it Low (maximum CVSSv3 base score 2.7) and lists no workarounds. Affected products include VMware ESX/ESXi, vCenter, Workstation, Fusion, Cloud Foundation, vSphere Foundation and Telco Cloud. The same advisory covers more severe flaws (vCenter CVE-2026-59309 and CVE-2026-59310, both 9.8; VMXNET3 out-of-bounds write CVE-2026-47876, 9.3; CVE-2026-41703). Third-party reporting says CVE-2026-59309/59310 were exploited in the wild, but the sources do not tie CVE-2026-41709 to a specific exploitation campaign. The defensive significance is audit-trail evasion: an actor with ESX administrative access may be able to act without leaving log evidence, which weakens detection and forensics on hypervisors.

CVE-2026-46300, nicknamed 'Fragnesia', is a Linux kernel networking flaw disclosed 2026-05-13 by William Bowling of V12 Security (public GitHub PoC, no embargo). skb_try_coalesce() moves paged fragments between sk_buffs but drops the SKBFL_SHARED_FRAG marker. The XFRM ESP-in-TCP input path then skips skb_cow_data() and performs in-place AES-GCM decryption over page-cache-backed pages. The keystream XOR gives a controlled write into cached file pages (a 192-byte XOR primitive via AES-GCM keystream per Tenable). The public PoC overwrites the cached copy of /usr/bin/su with a small position-independent ELF payload to get a root shell. No race condition is required. An unprivileged local user obtains CAP_NET_ADMIN through user and network namespaces, which are enabled by default on most distributions. NVD/CWE data lists CWE-456 and CWE-123, and the CVSS is reported as 7.8. The flaw bypasses the fixes for the 'Dirty Frag' bugs (CVE-2026-43284, CVE-2026-43500); the upstream fix cites the Dirty Frag fix commit f4c50a4034e6. Fixed stable kernels: 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1+. Tenable reported no in-the-wild exploitation at publication in May; the October KEV listing is the evidence of later exploitation. Amazon Linux is reportedly unaffected (no espintcp module).

Neither source identifies the exploiting actors, victims or infrastructure, so no network IOCs, attribution or sectors are asserted.

## MITRE ATT&CK

- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1106 Native API
- T1685 Disable or Modify Tools
- T1078 Valid Accounts
- T1565.001 Data Manipulation: Stored Data Manipulation

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CVE-2026-41709 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-41709)
- [CVE-2026-46300 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-46300)
- [Broadcom VMSA-2026-0006 Security Advisory](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017)
- [Tenable: CVE-2026-46300 (Fragnesia) FAQ](https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc)
- [TuxCare: Fragnesia (CVE-2026-46300) bypasses the Dirty Frag patch](https://tuxcare.com/blog/fragnesia-cve-2026-46300/)
- [V12 Security Fragnesia PoC](https://github.com/v12-security/pocs/tree/main/fragnesia)
- [Greenbone: Patch now - actively exploited VMware vCenter CVEs (VMSA-2026-0006)](https://www.greenbone.net/en/blog/patch-now-two-actively-exploited-cves-affecting-vmware-vcenter-server-and-more/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4669