A Linux kernel flaw that can give attackers root access has been added to the Cybersecurity and Infrastructure Security Agency's (CISA) catalog of actively exploited vulnerabilities.
CISA added CVE-2026-46300, known as Fragnesia, on Oct. 28, 2026. Attackers used the Linux privilege escalation vulnerability alongside remote code execution flaws to compromise Palo Alto Networks firewalls and reach internal infrastructure, according to security researchers.
Palo Alto Networks corroborated the findings on Oct. 29. The reported intrusions involved compromised firewall management systems, stolen credentials and attempts to access enterprise identity services.
Linux flaw linked to 25 compromised servers
CISA's Known Exploited Vulnerabilities listing sets an Oct. 31 remediation deadline for covered federal civilian agencies. Fragnesia carries a CVSS 3.1 score of 7.8, indicating high severity.
In an investigation updated Oct. 29, Dream Research reported 25 compromised firewall and management servers across the United States, Japan, Taiwan and South Korea. Three were associated with a US government-affiliated environment.
Dream Research reported root-level compromise of 24 exposed firewalls and one internal management server. At a US government-affiliated environment, attackers also established a persistent tunnel, extracted credentials and enumerated Active Directory accounts.
The activity resembles recent attacks on Cisco firewall management systems, in which compromised administration infrastructure provided access to internal networks.
How attackers escalated to root
Fragnesia stems from a Linux kernel defect that fails to preserve a shared-fragment marker when combining socket buffers. During encrypted packet processing, this can allow unintended modification of page-cache-backed data and create a path to root privileges.
The flaw does not independently grant remote access. Attackers first exploited two PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, through exposed PAN-OS management interfaces.
They then used Fragnesia to obtain root privileges. Dream reported that the complete attack chain could establish a persistent root webshell in under 15 minutes.
A separate Ivanti VPN intrusion involved a similar sequence of remote access and privilege escalation, followed by credential theft.
In an Oct. 29 threat brief, Palo Alto Networks Unit 42 independently verified the attacker's tooling and corroborated Dream's findings.
How organizations can mitigate the risk
Organizations should patch affected Linux systems, secure exposed management services and investigate potential compromise. Priority measures include:
- Apply security patches. Install distribution-specific kernel fixes and reboot where required. Check the Palo Alto Networks advisory for PAN-OS releases that address PHP2Shell.
- Restrict management access. Limit administrative interfaces to trusted networks and segment sensitive infrastructure. Recent Arista VeloCloud Orchestrator attacks also highlight the risk of exposed management services.
- Use temporary kernel mitigations when necessary. If an affected Ubuntu kernel cannot be patched immediately, follow Canonical's guidance for disabling
esp4andesp6. Assess IPsec dependencies first and remove the workaround after installing the security update. - Harden privileged access. Remove unnecessary local accounts, enforce least privilege and restrict privileged containers on vulnerable hosts.
- Investigate compromise indicators. Hunt for unexpected root activity, webshells, persistent tunnels and unusual Active Directory access.
- Test incident response plans. Validate containment, evidence preservation, credential rotation and recovery procedures for compromised management systems.
Patching closes known vulnerabilities but does not establish whether attackers already obtained access. Organizations should investigate exposed systems for persistence and compromised credentials before completing remediation.
Read more: An exploited Check Point management zero-day illustrates how vulnerabilities in centralized security platforms can expose administrative functions and require post-patch compromise investigations.