CISA has added two flaws to its Known Exploited Vulnerabilities catalog: a low-severity VMware ESXi logging bug, CVE-2026-41709, and a Linux kernel privilege escalation nicknamed Fragnesia, CVE-2026-46300. CrowdStrike separately reported that a China-nexus actor called Warp Panda used the ESXi flaw as a zero-day to hide its activity inside US victim networks, including law firms.
Warp Panda’s Use of a Low-Rated ESXi Logging Flaw as a Zero-Day
CVE-2026-41709 scores only 2.7 on the CVSS scale. It is an insufficient-logging bug: an attacker who already holds administrator rights can carry out certain operations on ESXi without those actions being recorded. Broadcom disclosed it on July 29 in advisories that also covered three critical and one high-severity flaw across vCenter, ESXi, Workstation and Fusion. The fixed ESXi builds are ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389, along with newer builds.
CrowdStrike says Warp Panda exploited the bug before the July disclosure, and in several intrusions as late as early 2026, to significantly reduce the audit trail left behind in victim environments.
How Warp Panda Reaches ESXi Hosts
According to CrowdStrike, Warp Panda usually gets in through internet-facing edge devices and then pivots to vCenter. In 2025 the group deployed a set of tools named BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit. Using the logging flaw after gaining administrator access let the operators remove evidence of what they did on the hypervisors, which are the systems that host many other servers.
How Fragnesia CVE-2026-46300 Breaks Page-Cache Protections
CVE-2026-46300 has a CVSS score of 7.8. When the Linux kernel merges network buffers, it loses a marker that flags a fragment as shared. IPsec ESP processing can then decrypt data in place over page-cache-backed fragments, which allows unintended modification of page-cache data.
Chaining Fragnesia With the PHP2Shell Flaws
CISA says attackers are chaining the kernel flaw with the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to implant PHP webshells and run commands as root. A separate report from the security firm Dream, covered in companion reporting, describes that chain being used against firewalls. CISA lists known ransomware use as “Unknown” for both newly added flaws.
Federal Deadlines and Where Both Flaws Sit in Broadcom’s July Batch
Federal civilian agencies must remediate the Linux kernel flaw by October 31, a window of three days from the catalog addition, and the ESXi flaw by November 11. The kernel fix reaches most organizations through their distribution vendors.
The ESXi bug sits alongside more serious problems from the same July 29 release. Two of the other flaws in that batch, CVE-2026-59309, a critical authentication bypass, and CVE-2026-59310, a critical directory traversal that leads to code execution, were already exploited in the wild. Quirso said roughly 360 internet-facing vCenter servers were compromised through CVE-2026-59310 in mid-August.
What a 2.7-Rated Bug Shows About CVSS Scores and Real-World Risk
The ESXi case is a pointed example of how a severity score and operational value can diverge. A CVSS 2.7 rating reflects the narrow technical effect of the bug, which requires existing administrator rights and only suppresses logs. For an intruder who already has those rights, suppressing logs on a hypervisor is worth far more than the score suggests, because it removes the evidence defenders would use to reconstruct the intrusion.
The analysis does not change the patching order of the underlying flaws, but it does bear on how organizations triage a long advisory. Teams that skip low-rated items in a batch like Broadcom’s July release leave the one fix that an actor with administrator access would value most for hiding its tracks. The fact that CrowdStrike dates the exploitation to 2025 and early 2026 also means that logs from before the patch may be incomplete in ways that no update can repair.
CISA’s addition of the kernel flaw alongside the PHP2Shell chain points to a second pressure: the entry point in these attacks is PHP, so closing that hole matters as much as the kernel fix.
