CVE-2026-46300, dubbed Fragnesia, is a new development in the saga. It is identified as part of the Dirty Frag vulnerability class, a set of local privilege escalation (LPE) bugs in the Linux kernel.
The Dream researchers described an attack they tracked in the wild, in which threat actors built a persistent tunnel into an internal network “within hours.” They developed two distinct exploits, stringing them together to target any Palo Alto Network firewall running a vulnerable build of PAN-OS, and achieved root access in a single HTTP request without any credentials.
After rooting the firewalls, the threat actor launched attacks against Active Directory (AD), giving them the ability to extract credentials and discover hidden files, folders, and other sensitive resources, according to the Dream researchers. The researchers confirmed that the threat actor then possessed a full AD user group listing and “complete organizational blueprint,” private keys and complete network topology, including the IP, hostname, server role, and VPN gateway, and had accessed decrypted service account credentials allowing direct AD queries at any time.
