CISA adds Broadcom VMWare ESX and Linux Kernel flaws to catalog

The Cybersecurity and Infrastructure Security Agency added two security flaws to its Known Exploited Vulnerabilities Catalog on October 28, 2026, based on evidence of active exploitation. CISA Alerts reported that the agency added CVE-2026-41709, an insufficient logging vulnerability in Broadcom VMWare ESX, and CVE-2026-46300, a missing initialization of a variable vulnerability in the Linux Kernel. [1]

CISA Alerts noted that these vulnerability types serve as frequent attack vectors for malicious cyber actors and create significant risks to federal enterprises. The agency added that Binding Operational Directive 26-04 establishes vulnerability management rules for Federal Civilian Executive Branch agencies. This directive mandates rapid remediation for all cataloged security issues. [1]

As FTMQ Security reported earlier, CISA added two actively exploited PHP flaws, CVE-2026-109618 and CVE-2026-109619, to the same catalog on October 26, 2026. Prior to that, FTMQ Security reported that CISA added an OS command injection flaw in Collabora Online, tracked as CVE-2026-110447, to the list on October 23, 2026. [11][12]

Federal agencies must prioritize and execute rapid security updates to comply with the federal directive to protect critical infrastructure from cyber attacks. [1]