CISA Flags Actively Exploited VMware ESXi and Linux Kernel Flaws

What Happened

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-41709 affecting Broadcom VMware ESXi (an insufficient logging flaw) and CVE-2026-46300 in the Linux kernel (a missing variable initialization bug). Both are confirmed to be exploited in the wild by threat actors. CISA's Binding Operational Directive 26-04 requires federal agencies to prioritize patching these high-risk vulnerabilities on publicly exposed assets, particularly those that grant total control post-exploitation.

Why SMBs Should Care

VMware ESXi is a common hypervisor in small and mid-sized data centers, and Linux underpins countless servers, appliances, and cloud instances. Active exploitation means attackers are already using these flaws, often as entry points for ransomware or data theft. The ESXi logging vulnerability is especially concerning because it can hide attacker activity, making incident response harder. If you run VMware infrastructure or Linux servers, prioritize patching immediately. Check with your vendors for updates, review your backup integrity, and consider whether you need forensic analysis if systems were exposed before patching.

Read the full CISA alert

Need help assessing your VMware or Linux environment? O-Cyrus provides infrastructure security assessments, patch management, and incident response for SMBs. Contact us or explore our security services.