CISA orders agencies to patch Fragnesia Linux flaw chained in firewall attacks

CISA added CVE-2026-46300, nicknamed Fragnesia, to its Known Exploited Vulnerabilities catalog on Oct. 28, 2026, and ordered federal civilian agencies to patch by Oct. 31 under Binding Operational Directive 26-04. The agency’s catalog entry says attackers can chain Fragnesia with the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to plant web shells and execute commands with root privileges.

Dream Security said the campaign rooted 25 servers across the United States, Japan, Taiwan and South Korea. Dream Security also counted a 25th system, a firewall management server at a US government-affiliated organization, as compromised, and the attacker then targeted Active Directory.

Dream Security reported that attackers rooted 24 firewalls on Oct. 23 and 24 using the full PHP2Shell-Fragnesia chain and dropped a PHP root web shell on each. The first firewall taken over on Oct. 23 crashed soon after the exploit, while a second attack wave on Oct. 24 worked.

Dream Security’s timeline shows operation setup began on Oct. 8, the first firewall fell on Oct. 23 at 18:14 UTC, the government-linked firewall fell on Oct. 24 at 10:09 UTC, and the management server was reached through a reverse SSH tunnel at 11:35 UTC. From that server the attacker decrypted an LDAP service account password, enumerated domain users and groups, ran password spraying and tried to create Active Directory backdoor accounts.

CyberExperts.com said PHP2Shell consists of unauthenticated remote-code-execution bugs in PHP that were fixed on Oct. 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. HashgraphOnline said Fragnesia by itself is not a remote attack: an attacker needs code already running on the machine, such as through a web-application flaw, a stolen SSH login or a compromised build job.

Fragnesia is a high-severity Linux kernel privilege-escalation flaw tied to a logic bug in the XFRM ESP-in-TCP subsystem that permits code execution with root permissions. It belongs to the Dirty Frag class, and a published proof of concept lets unprivileged local attackers obtain root on major Linux distributions using kernels released before May 13, 2026.

NVD rates CVE-2026-46300 at 7.8 on CVSS 3.1 with a local attack vector. Red Hat rates the flaw Important instead of Critical because exploitation by itself requires local access. Tenable says a public proof of concept exists and works on standard distribution setups because user and network namespaces are active by default.

The flaw sits in the skb_try_coalesce() function, which merges network buffers without carrying the shared-frag marker, letting ESP input processing decrypt in place over shared page-cache memory. An unprivileged user can write arbitrary bytes into the cached in-memory copy of a read-only file while the disk copy remains unchanged. The public exploit appeared on May 13, 2026, and patched stable kernels and distribution packages arrived in the weeks after.

In the Dream Security intrusion, the attacker changed /etc/pam.d/su so that su root accepts any password while the on-disk file stayed the same. A reboot erases the in-memory backdoor and the evidence together, so defenders should inspect memory before restarting. Defenders can compare cached and on-disk copies of files such as /usr/bin/su and /etc/pam.d/su and look for pam_permit entries to spot the in-memory change.

Dream Security’s Oct. 26 report described target lists, exploitation logs and roughly 40 custom post-exploitation scripts from the chained operation. Adel Karimi of Perplexity said weekend honeypot logs showed code execution on an Apache server running PHP 8.4.26.

According to Dream Security, a suspected China-linked actor used the FOFA search engine to find about 19,000 internet-facing firewalls from one unnamed vendor, then narrowed the pool to 240 targets in Taiwan, South Korea, Japan and the United States. Dream Security believes the activity is part of a Chinese-nexus operation but has not attributed it to a specific threat actor, and these findings are Dream’s rather than CISA’s, SecurityWeek and Red Tiger Security said.

The firewalls in Dream’s report ran PHP 8.0.30, a branch that PHP no longer patches. The PHP2Shell patch deadline for federal agencies was Thursday, Oct. 29, 2026.

Binding Operational Directive 26-04 covers only federal civilian agencies, though CISA urges every organization to prioritize KEV entries. CISA flagged the KEV listing for forensic triage, meaning agencies should determine whether systems were previously compromised instead of merely applying patches, and the directive’s forensic-triage requirement binds only US federal agencies.

Systems that cannot reboot yet can block the esp4 and esp6 kernel modules as a temporary measure, although this disables IPsec, and defenders should not use it on VPN gateways. Disabling unprivileged user namespaces is another mitigation, but it may affect rootless containers, sandboxed browsers and Flatpak. Defenders should ask firewall, VPN and storage vendors in writing whether firmware includes the CVE-2026-46300 fix and keep management interfaces off the internet until patched.

Upstream fixed kernels include 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10 onward, while version 7.1 is not affected. Ubuntu fixed kernels include 7.0.0-22.22 for 26.04 LTS, 6.17.0-35.35 for 25.10, 6.8.0-124.124 for 24.04 LTS and 5.15.0-181.191 for 22.04 LTS; Canonical lists Ubuntu 20.04 with the standard 5.4 kernel as unaffected, while its HWE 5.15 kernel needs Ubuntu Pro for the fix.

Debian fixed kernels include 6.12.90-1 for trixie, 6.1.174-1 for bookworm and 5.10.257-1 for bullseye LTS. Red Hat Enterprise Linux 8, 9 and 10, plus RHEL CoreOS, OpenShift, OpenStack and Virtualization using the RHEL kernel, have received fixes.

NVD and the Linux CNA record disagree on whether kernel 5.10.257 is patched, with NVD listing the range through 5.10.257. Siemens advisory SSA-019113 lists affected SIMATIC S7-1500 MFP controllers and provides a fix in V3.1.7, putting embedded Linux devices in scope. Patches for the Dirty Frag CVEs CVE-2026-43284 and CVE-2026-43500 from early May do not equal patches for Fragnesia.