CISA put two more flaws into its Known Exploited Vulnerabilities catalog on October 28. One is a Linux kernel bug that hands root to any local user. The other is a VMware ESX logging gap that carries a CVSS score of 2.7, which is about as low as a score gets before it stops being worth a CVE.
That second one is the interesting entry. A 2.7 doesn’t land in KEV by accident. It lands there because someone used it.
A Low Score That Tells You Who Was Inside
CVE-2026-41709 lets a malicious administrator on VMware ESX carry out certain operations without them showing up in the logs. Broadcom fixed it on July 30 in VMSA-2026-0006, the same advisory that patched a 9.8 authentication bypass in vCenter and a 9.3 VM escape through the VMXNET3 adapter. Next to those two, a logging bug looked like housekeeping. Most teams triaged it last, if at all.
Read the precondition again, though. The attacker already needs admin rights on the hypervisor. Nobody exploits this to get in. They exploit it after they’re in, to stay quiet while they work. So a KEV listing for this CVE says less about the bug and more about the intrusions behind it: somebody had admin on ESX hosts and cared enough about the audit trail to erase their tracks.
The affected range covers ESX 8.0 before build ESXi80U3j-25429389, the 9.0 and 9.1 lines before their July fixes, plus Cloud Foundation, vSphere Foundation and Telco Cloud Platform. Federal civilian agencies must patch by November 11. Anyone who skipped the July advisory should treat the host logs from before the patch as incomplete, and go looking in a log store the hypervisor can’t touch.
Fragnesia Gets a Three-Day Deadline
CVE-2026-46300, known as Fragnesia, is a local privilege escalation in the kernel’s XFRM ESP-in-TCP path. William Bowling of V12 Security disclosed it on May 13 with a working proof of concept. It rates 7.8.
The mechanism is neat and nasty. When the kernel coalesces socket buffers, it can drop the marker that flags a fragment as shared, page-cache-backed memory. ESP then thinks the fragment is safe to decrypt in place. It isn’t. The decryption writes straight into the cached copy of a read-only file. The public exploit goes after the cached copy of /usr/bin/su, so the binary on disk stays clean while every run of su executes the attacker’s code until the cache clears or the box reboots. File integrity checks that hash the disk won’t see a thing.
CISA says attackers are chaining it with CVE-2026-109618 and CVE-2026-109619 to plant PHP webshells and run commands as root. That’s a web server story. Get code execution as the web user, climb to root through the kernel, leave a shell behind.
The federal deadline is October 31. Three days. Kernels built before the May 13 netdev fix are exposed, and containers share the host kernel, so a foothold inside one is a foothold on the host. Where a patched kernel can’t go in this week, unloading and blacklisting the esp4, esp6, rxrpc and espintcp modules closes the path, at the cost of IPsec on that machine.
Severity Scores Are the Wrong Queue
Put the two entries side by side and the lesson writes itself. Patch queues sorted by CVSS would have pushed the ESX fix to the bottom in July and left Fragnesia waiting behind louder bugs since May. Attackers don’t sort that way. They pick what fits the job, and covering tracks on a hypervisor is a job.
KEV is the better list for a reason. Check it weekly. Then check what your own logs can still prove.
The full catalog is on CISA’s KEV page.