Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including CVE-2026-41709 and CVE-2026-46300. These vulnerabilities highlight the importance of staying up-to-date with the latest security patches and updates, and organizations are advised to review the catalog and address the vulnerabilities in their infrastructure. The growing threat landscape in the cybersecurity world requires attention and action from organizations and individuals alike, and it is essential to stay informed and adapt to the latest security patches and updates.
US CISA has added two new vulnerabilities, CVE-2026-41709 and CVE-2026-46300, to its KEV catalog. CVE-2026-41709 is a critical flaw in VMware ESX, allowing attackers to hide activities and evade detection. CVE-2026-46300 is a local privilege escalation flaw in XFRM ESP-in-TCP subsystem, allowing attackers to gain full root access. US CISA orders federal agencies to fix the vulnerabilities by November 11, 2026 and October 31, 2026. Private organizations are also recommended to review the catalog and address the vulnerabilities in their infrastructure.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These additions come as a reminder to organizations and individuals to address the growing threat landscape in the cybersecurity world. The two vulnerabilities in question are CVE-2026-41709 and CVE-2026-46300, both of which have been identified as insufficient logging and missing initialization of a variable in the Linux kernel and Broadcom VMWare ESX, respectively.
The CVE-2026-41709 vulnerability, also known as the Broadcom VMWare ESX Insufficient Logging Vulnerability, has been identified as a critical flaw in the VMware ESX system. This vulnerability allows a malicious user with administrator privileges to perform certain operations on the affected system without those actions being recorded in the logs. This could allow an attacker to hide specific activities and make it harder for security teams to detect suspicious behavior, investigate incidents, and determine what happened. The flaw does not itself grant administrator privileges; the attacker must already have them.
The CVE-2026-46300 vulnerability, also known as the Fragnesia vulnerability, is a local privilege escalation flaw in the XFRM ESP-in-TCP subsystem. This vulnerability allows local attackers to gain full root access by corrupting the kernel page cache. Security experts warn that the issue is dangerous because attackers with low privileges can modify read-only files in memory and take complete control of vulnerable systems.
The discovery of these vulnerabilities is a reminder of the importance of staying up-to-date with the latest security patches and updates. The U.S. CISA has ordered federal agencies to fix CVE-2026-41709 by November 11, 2026, and CVE-2026-46300, by October 31, 2026. Experts also recommend that private organizations review the catalog and address the vulnerabilities in their infrastructure.
The growing threat landscape in the cybersecurity world is a concern that requires attention and action from organizations and individuals alike. As the threat actor landscape continues to evolve, it is essential to stay informed and adapt to the latest security patches and updates. By doing so, organizations can protect their networks and systems from attacks exploiting the vulnerabilities in the catalog.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-Linux-Kernel-and-Broadcom-VMWare-ESX-Flaws-to-Its-Known-Exploited-Vulnerabilities-Catalog-A-Growing-Concern-for-Cybersecurity-ehn.shtml
https://securityaffairs.com/202050/hacking/u-s-cisa-adds-linux-kernel-and-broadcom-vmware-esx-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-41709
https://www.cvedetails.com/cve/CVE-2026-41709/
https://nvd.nist.gov/vuln/detail/CVE-2026-46300
https://www.cvedetails.com/cve/CVE-2026-46300/
Published: Thu Oct 29 13:07:38 2026 by llama3.2 3B Q4_K_M
