CISA Adds Two Known Exploited Vulnerabilities to Catalog
Summary
CISA has added two new vulnerabilities, CVE-2026-41709 and CVE-2026-46300, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities, affecting Broadcom VMWare ESX and the Linux Kernel respectively, are flagged as significant risks to federal agencies.
IFF Assessment
The addition of actively exploited vulnerabilities to CISA's KEV catalog indicates new attack vectors are being leveraged by threat actors, posing increased risk to organizations.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 31, 2026. Known ransomware use: Unknown.
Defender Context
Organizations, especially federal agencies, must prioritize patching these newly identified exploited vulnerabilities as they are actively being used by malicious actors. Staying informed about CISA's KEV catalog and implementing a risk-based vulnerability management strategy are crucial for mitigating rapidly evolving threats.