VMware ESX and Linux Kernel: CISA Reports Attacks on CVE-2026-41709 and Fragnesia

On October 28, 2026, the U.S. agency CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-41709 in VMware ESX and CVE-2026-46300 in the Linux kernel, known as Fragnesia. Updates for both have been available for months. Attackers have used both vulnerabilities with a clear purpose, even though they are rated low and high rather than critical: one to avoid leaving traces, the other to gain root privileges after initial access.

CVE-2026-41709: ESX does not log all operations

Broadcom published the vulnerability on July 29, 2026, in advisory VMSA-2026-0006, together with several critical vulnerabilities in ESX, vCenter, Workstation, and Fusion. According to the advisory, a malicious administrator can perform certain operations on the ESX host without those operations being logged. Broadcom rates this as CVSS 2.7, low, because the attacker already requires administrator privileges. There is no workaround.

The low rating describes the vulnerability in isolation. In an attack, it has a different function: anyone who already controls the virtualization environment can use it to execute commands that will be missing from subsequent forensic investigations. In its Legal Threat Landscape Report 2026, CrowdStrike describes how the China-linked group Warp Panda placed malware in vCenter environments during intrusions into U.S. organizations, including law firms, and exploited CVE-2026-41709 as a zero-day in several cases, most recently in early 2026. The vulnerability was therefore exploited several months before the patch.

Fixed versions according to Broadcom:

The ESX Shell displays a host’s installed version and build:

esxcli system version get

For assessing a potential incident, this means that local logs on ESX hosts compromised before the update are incomplete. Comparing them with external sources (vCenter events, network and firewall logs, and backup software logs) is therefore more informative than the host log alone.

CVE-2026-46300 (Fragnesia): Root via the Page Cache

Fragnesia is a variant of the Dirty Frag vulnerability and resides in the kernel’s XFRM-ESP subsystem, specifically ESP-in-TCP (IPsec over TCP). It gives an unprivileged local user write access to the Page Cache, allowing them to modify cached contents of files they are only permitted to read. The public exploit modifies /usr/bin/su and launches a root shell. William Bowling of Zellic published the vulnerability, exploit, and patch on May 13, 2026; Microsoft warned shortly afterward. Red Hat rates it CVSS 7.8. The patches for Dirty Frag do not fix Fragnesia; it requires a separate kernel fix.

Major distributions provide fixed kernels through their regular updates, for example AlmaLinux 8 starting with kernel-4.18.0-553.124.2.el8_10, AlmaLinux 9 starting with kernel-5.14.0-611.54.4.el9_7, and Ubuntu 20.04 starting with 5.15.0-181.191~20.04.1. For other distributions, consult the relevant advisory; Ubuntu points out that version numbers alone say little when backports are used.

The following shows whether the affected modules are loaded:

lsmod | grep -E '^(esp4|esp6|rxrpc) '

Until a fixed kernel is installed, the modules can be unloaded and prevented from loading again. This is only possible if the system does not need IPsec:

rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf

The attack chain via php2shell

Dream Research describes how Fragnesia is used in practice in an analysis dated October 26, 2026. Between October 8 and 24, an attacker compromised 25 firewall servers in the United States, Japan, Taiwan, and South Korea. Dream does not name the vendor. The chain consisted of two steps in a single HTTP request:

1. Initial access via php2shell: The two PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow code execution on the firewall’s management web server, in the described case as user nobody.
2. Privilege escalation via Fragnesia: SELinux prevented the web server process from modifying system files. The attacker therefore overwrote /etc/pam.d/su through the Page Cache with pam_permit.so and gained passwordless root privileges using su.

On one firewall belonging to the target organization, the attacker then established a persistent SSH reverse tunnel, took over the internal management server, decrypted the LDAP service account password, and attacked Active Directory. The remaining 22 firewalls were left with a web shell. Dream attributes the campaign to a China-linked actor and sees indications of AI-assisted development of the roughly 40 scripts, without direct evidence.

This makes local privilege escalation relevant for appliances as well: a web application with restricted privileges is sufficient as a starting point if the kernel is unpatched.

php2shell and PAN-OS

PHP closed the php2shell vulnerabilities on October 21, 2026 (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35); CISA has listed both in the KEV catalog since October 26. Palo Alto Networks reports active attacks against the PAN-OS management web interface through these vulnerabilities (advisory CVE-2026-109618, CVSS 4.0 9.2). PA-Series and VM-Series firewalls as well as Panorama are affected; according to the vendor, GlobalProtect and Captive Portal are not affected. Hotfixes have been released for supported versions 10.2 through 12.2; for 11.1.7-h12, the advisory specifies October 30, 2026. The risk is greatest when the management interface is reachable from the internet; Palo Alto recommends restricting access to trusted internal addresses.

What to do now

1. Update ESX hosts to the fixed versions in VMSA-2026-0006. The advisory also closes the critical vulnerabilities CVE-2026-59309, CVE-2026-59310, and CVE-2026-47876.
2. Update Linux systems to a kernel containing the Fragnesia fix and reboot them. This also applies to Linux-based appliances, for which the vendor must provide a separate update.
3. Update PHP to the versions from October 21, 2026, or a distribution backport; for PAN-OS, apply the hotfixes from the advisory.
4. Do not make management interfaces for firewalls, hypervisors, and vCenter reachable from the internet.
5. If ESX hosts are suspected of being compromised, compare their logs with external sources because the host log may be incomplete before the update.