On October 28 CISA added a flaw in the Linux kernel to the Known Exploited Vulnerabilities catalog and set a deadline of October 31.
Three days. The second flaw is in VMware ESX, its deadline is November 11, and it is a different kind.
Fact
The facts: on October 28, 2026 CISA added two entries to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-41709 is an insufficient logging flaw in Broadcom's VMware ESX: according to Broadcom, a malicious administrator could perform certain operations without them being logged. Broadcom rates it low, with a maximum CVSSv3 base score of 2.7. CISA's deadline is November 11, 2026. Broadcom's advisory VMSA-2026-0006 was published on July 29, 2026 and last updated on August 19, 2026; the fixed versions are ESXi-9.1.0.0-25370933 for 9.1, ESXi-9.0.2.0100-25595025 for 9.0, ESXi80U3j-25429389 for 8.0 and 5.2.4 for VMware Cloud Foundation 5.x; Broadcom lists no workaround. CVE-2026-46300 is a Linux kernel flaw filed as a missing initialization of a variable. NVD published it on May 23, 2026 and scores it 7.8 (high); the attacker must already be on the machine, with ordinary rights. CISA's deadline is October 31, 2026. Broadcom's advisory does not say the ESX flaw is used in attacks: that is the claim made by the CISA listing.
The ESX flaw is rated low, and that should be said plainly. It lets nobody in: it needs administrator rights, so the attacker has to be inside already. What it gives them is the chance to do something without it landing in the log. A low score for a flaw that leaves no tracks.
Neither one is new. Broadcom's advisory is from July 29, and the NVD entry for the kernel flaw is from May 23, with links to the patches. They only make the catalog now.
The patch is old. The deadline is not.
Why CISA lists them right now, it does not say, and who uses them and against whom, it does not say either.
If you run Linux servers, the kernel comes first: CISA's deadline is October 31. Check your ESX hosts against the fixed versions in Broadcom's advisory, before November 11.
Sources
CISA KEV (CVE-2026-41709, CVE-2026-46300)Broadcom VMSA-2026-0006 (CVE-2026-41709)NVD (CVE-2026-46300)The visual is generated code-art, no third-party images.