---
title: CISA adds the Linux kernel "Fragnesia" bug (CVE-2026-46300) to KEV with a three-day federal deadline of Oct 31 and a forensic-triage flag, plus a VMware ESX logging gap (CVE-2026-41709) due Nov 11 | ctxsec
url: https://ctxsec.com/items/kev-oct-28-linux-fragnesia-esx-logging-due-oct-31
description: ""
status: "official (CISA KEV catalog and alert, Oct 28); Fragnesia due Oct 31 with forensic triage required; ESX due Nov 11"
published: 2026-10-28
---

> 

[← Cybersecurity News](/news) · [markdown](/items/kev-oct-28-linux-fragnesia-esx-logging-due-oct-31.md)

official (CISA KEV catalog and alert, Oct 28); Fragnesia due Oct 31 with forensic triage required; ESX due Nov 11

2026-10-28

### CISA adds the Linux kernel "Fragnesia" bug (CVE-2026-46300) to KEV with a three-day federal deadline of Oct 31 and a forensic-triage flag, plus a VMware ESX logging gap (CVE-2026-41709) due Nov 11

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct 28, "based on evidence of active exploitation". Ransomware use is listed as unknown for both.

- **CVE-2026-46300, Linux kernel ("Fragnesia"):** a missing-initialization bug (CWE-456) in which the shared-fragment marker is lost during socket-buffer coalescing, so ESP input processing decrypts shared fragments in place and can modify page-cache-backed data. CISA's entry says it can be chained with PHP2Shell (CVE-2026-109618 and CVE-2026-109619) "to implant PHP webshells and run commands as root", which matches the [firewall campaign Dream Research described](/items/dream-php2shell-fragnesia-chain-roots-24-firewalls-us-gov). The federal due date is **Oct 31**, and it carries CISA's **forensic-triage** flag, meaning agencies must check for prior compromise, not just patch. CISA notes it affects an open-source component that may sit inside many products, and links eight stable-kernel fix commits.
- **CVE-2026-41709, VMware ESX:** an insufficient-logging flaw (CWE-778) that lets someone who already has admin access perform certain operations without them being logged. Broadcom rated it Low (CVSS 2.7) in VMSA-2026-0006 on July 29 and credited Ian Barton of CrowdStrike. Fixed builds are ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, VCF 5.2.4, and KB449886 for Telco Cloud Platform. Due Nov 11, no forensic-triage flag.

**What to do:** update Linux kernels to a stable release containing the Fragnesia fix, starting with internet-facing hosts and appliances that run PHP, and check `/etc/pam.d/su` and other root-owned files against known-good copies (see [hunt notes](/items/hunt-php2shell-fragnesia-firewall-root-artifacts)). For ESX, a low-severity bug in KEV usually means it was used to hide activity after an intrusion, so patch to the VMSA-2026-0006 builds and treat any ESX host with unexplained admin sessions as worth a closer look. CISA does not say whose exploitation evidence it relied on.

Sources: [CISA alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 28)](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog) · [CISA KEV catalog (JSON feed, Oct 28 entries)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) · [Broadcom VMSA-2026-0006: VMware ESX, vCenter, Workstation and Fusion updates (CVE-2026-41709 is item 3e)](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) · [NVD: CVE-2026-46300](https://nvd.nist.gov/vuln/detail/CVE-2026-46300) · [NVD: CVE-2026-41709](https://nvd.nist.gov/vuln/detail/CVE-2026-41709)