Fragnesia CVE-2026-46300 and VMware ESX CVE-2026-41709: CISA Confirms Both Are Exploited, and What to Patch This Week

CISA has confirmed that attackers are exploiting two flaws. The first is CVE-2026-46300, a Linux kernel bug nicknamed Fragnesia that lets an ordinary user on a server become root. The second is CVE-2026-41709, a VMware ESX flaw that lets an administrator carry out some actions without them being logged. If your business runs Linux web servers or VMware hosts, both belong on this week's patch list. The Linux flaw is the more urgent one, because CISA links it to attacks that plant PHP webshells on websites.

What CISA added to the KEV catalog on October 28, 2026

On October 28, 2026, CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog "based on evidence of active exploitation." The KEV catalog is CISA's list of flaws it has evidence are being used in real attacks. Federal civilian agencies have to fix them by set deadlines. For everyone else, the list is a strong signal about what to fix first.

CISA lists ransomware use as "Unknown" for both.

What is confirmed about Fragnesia (CVE-2026-46300)

• It has been public since May. Fragnesia was discussed on the oss-security mailing list on May 13, 2026, together with a proof of concept exploit. That post says the exploit rewrites the start of /usr/bin/su in the page cache (the kernel's in-memory copy of a file) to get a root shell, while the file on disk stays unchanged.
• It belongs to the Dirty Frag family. Red Hat covers it in security bulletin RHSB-2026-003 together with the earlier Dirty Frag flaws. Red Hat rates it Important rather than Critical because the attacker needs local access first.
• Ubuntu rates it High and gives the reason as "Trivial local privilege escalation." Ubuntu also says it could possibly be used to escape a container.
• CISA says how it fits into attacks. CISA's KEV entry says the flaw "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root." Those two are PHP flaws that CISA added to KEV on October 26, 2026. CISA describes both as allowing unauthenticated remote code execution.

In plain terms: a PHP flaw lets an attacker on the internet run code as the web server user. Fragnesia then turns that foothold into full root control of the server. CISA requires federal agencies to run forensic triage on affected systems, which means checking whether the server was already compromised, not just patching it.

What is confirmed about the VMware ESX flaw (CVE-2026-41709)

• Broadcom fixed it in security advisory VMSA-2026-0006, first published July 29, 2026 and last updated August 19, 2026.
• Broadcom rates it Low (2.7), because the attacker must already have administrator rights.
• The same advisory fixes more serious flaws: two vCenter flaws rated 9.8 (CVE-2026-59309, an authentication bypass in the VMware Directory Service, and CVE-2026-59310, a directory traversal flaw in the Syslog server) and an ESX VMXNET3 flaw rated 9.3 (CVE-2026-47876) that lets an administrator inside a virtual machine run code on the host.
• The Broadcom advisory itself does not say whether any of these flaws are being exploited. CISA's October 28 addition covers only CVE-2026-41709.

What is not known

• CISA has not named the attackers behind either flaw, which organizations were hit, or when the attacks began.
• For Fragnesia, CISA describes the chain with the PHP flaws but has not published victim counts or a breach report.
• For ESX, CISA has not said how the logging flaw is being used. Our reading is that a logging gap is most useful to someone who already has admin access and wants to avoid leaving a trail. That is our inference, not a CISA statement.

Why this matters for a company network or website

Linux web servers. If your website or customer portal runs PHP on Linux (WordPress, Drupal, Laravel or a custom app), an unpatched PHP install plus an unpatched kernel gives an attacker a route from the internet to root. Root means they can change any file, read your databases, hide tools and wipe their tracks. Patching after the fact does not remove a webshell that is already in place, so checking matters as much as updating.

VMware hosts. ESX runs the virtual servers your business depends on, and its logs are what you rely on after an incident. If someone with admin access can act off the record, your investigation has holes in it right when you need it.

What to do this week: fixed versions and how to check

Linux kernel (Fragnesia)

If you use another distribution or build your own kernel, check your vendor's advisory or the stable kernel commits listed in the CVE record.

VMware ESX (CVE-2026-41709)

The advisory lists later builds for the other ESX and vCenter flaws, such as ESXi80U3k-25595708 for 8.0 U3. Check the response matrix and install the build that covers every CVE in the advisory, not just this one.

PHP (the other half of the chain)

The PHP Group's CVE records list fixes in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Run php -v, or check your hosting control panel. If your distribution backports fixes, check its advisory instead of the version number.

Checklist

1. List every Linux server you run, including web servers, container hosts and appliances.
2. Install the fixed kernel and reboot. A kernel update does nothing until the server restarts, unless you use a live patching service that covers this CVE.
3. If you cannot reboot yet, Red Hat's bulletin gives two stopgaps: block the esp4 and esp6 modules (this breaks IPsec VPNs, so check with lsmod first), or turn off unprivileged user namespaces (this can affect rootless containers and sandboxed apps). Red Hat says neither is a complete fix.
4. Update PHP on every web server.
5. Look for webshells: new or recently changed .php files in web folders and upload folders, and unknown cron jobs or user accounts.
6. Update ESX hosts and vCenter to the builds in VMSA-2026-0006.
7. Review who has ESX and vCenter admin rights, and send host logs to a separate log system that host admins cannot edit.

Fragnesia and VMware ESX questions people are asking

What is Fragnesia?

Fragnesia is the nickname for CVE-2026-46300, a Linux kernel flaw in the code that handles IPsec traffic (ESP-in-TCP). It lets a local user write into the in-memory copy of read-only files and become root.

Can Fragnesia be exploited remotely?

Not on its own. The attacker first needs to run code on the machine. CISA says it can be chained with the PHP flaws CVE-2026-109618 and CVE-2026-109619, which can be exploited remotely, to plant webshells and run commands as root.

Is Fragnesia the same as Dirty Frag?

No. It is a separate bug in the same area of the kernel. Red Hat covers both in one bulletin, and the same stopgap steps apply to both.

Do I need to reboot after the kernel update?

Yes. The fixed kernel only runs after a restart, unless you use a live patching service that covers CVE-2026-46300.

Why is a low-severity VMware ESX flaw on CISA's exploited list?

Severity scores rate a flaw on its own. CISA lists flaws based on evidence of real-world use, not on the score. A logging gap can matter a great deal to an attacker who already holds admin rights.

Does CVE-2026-41709 affect VMware Workstation or Fusion?

No. Broadcom's advisory lists only ESX, Cloud Foundation, vSphere Foundation and Telco Cloud Platform for this CVE.

Do CISA's deadlines apply to private businesses?

No, they bind federal civilian agencies only. They still make a sensible benchmark: the federal deadline for Fragnesia has already passed.

The bigger lesson

Neither of these flaws looks alarming on its own: one needs local access, the other scores 2.7. Attackers don't use flaws on their own, though. They chain a web bug to a kernel bug, or stolen admin access to a logging gap. Patch based on what is being exploited, not only on the score, and check for signs of compromise as well as installing the fix.

Need help locking down your servers? See security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at /security-alerts.

Sources: CISA KEV alert, October 28, 2026; CISA KEV catalog data; Broadcom VMSA-2026-0006; CVE-2026-46300 record; Red Hat RHSB-2026-003; Ubuntu CVE-2026-46300; Debian security tracker; oss-security, May 13, 2026; PHP CVE-2026-109619 record.