CISA Adds Fragnesia Vulnerability to Active Exploit List
The Linux kernel flaw allows attackers to gain root access, prompting an October 31 remediation deadline for federal agencies.
Updated on Oct. 30, 2026 in Cybersecurity
Live Poll
Do you trust that your personal or workplace digital accounts are adequately protected from modern cyber threats?
CISA has added the Linux kernel vulnerability Fragnesia to its Known Exploited Vulnerabilities catalog. Attackers are currently using the flaw, which carries a CVSS 3.1 score of 7.8, to gain root privileges on compromised firewall and management servers.
Why it matters
The vulnerability enables attackers to escalate access to root levels after an initial breach, posing a significant risk to network infrastructure. The active exploitation of this kernel-level flaw necessitates immediate patching across critical environments.
The Fragnesia vulnerability, tracked as CVE-2026-46300, holds a CVSS 3.1 severity score of 7.8. It enables an attacker to secure root privileges within 15 minutes of initial system access.
The players
CISA
The Cybersecurity and Infrastructure Security Agency is the lead U.S. federal agency for cybersecurity oversight and vulnerability cataloging.
Palo Alto Networks
A global cybersecurity firm providing network firewalls and threat intelligence services that corroborated the breach findings.
Dream Research
The security research group that identified the 25 compromised firewall and management servers.
The details
Fragnesia allows for unauthorized root-level access by failing to properly preserve a shared-fragment marker during the processing of encrypted network packets. Attackers gain entry by exploiting two PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, within exposed PAN-OS management interfaces. Once the initial code execution is established, the Fragnesia flaw is triggered to escalate those privileges to the system root level.
Timeline
October 28, 2026: CISA added Fragnesia to the active exploitation catalog.
October 29, 2026: Palo Alto Networks confirmed the attacker tooling used in the breaches.
October 31, 2026: Federal civilian agencies face a deadline to complete system remediation.
The Tech Race
This incident follows the standard enforcement protocols set by CISA's Binding Operational Directive 22-01 regarding critical vulnerabilities. Researchers and vendors are currently racing to identify further compromised systems before the escalation leads to widespread unauthorized access.
Organizations running internet-facing firewall or management interfaces should immediately audit their systems for unauthorized access and apply the latest vendor patches. Federal agencies are specifically required to complete all necessary remediation steps by the October 31, 2026, deadline.
The takeaway
The rapid escalation from initial PHP remote code execution to root-level control highlights the danger of exposed management interfaces. Security teams should prioritize patching kernel vulnerabilities alongside application-level flaws to prevent persistent system compromise.
Further reading
For broader technical context on critical infrastructure threats, see our recent updates in Cybersecurity.
Source note: This article includes information reported by ESecurityPlanet.
Live Poll
Do you trust that your personal or workplace digital accounts are adequately protected from modern cyber threats?
