{"id":"redhat-abrt-symlink-privilege-escalation-aug-2026","category":"patch","status":"closed","title":"Red Hat ABRT privilege escalation CVE-2015-5287, a 2015 bug, added to CISA's exploited list","tldr":"CISA says attackers are using CVE-2015-5287, an old flaw in Red Hat's crash reporter ABRT that lets a local user become root. It matters on RHEL/CentOS 6 and 7 servers. Install the abrt and libreport updates, or remove ABRT, and retire unsupported systems.","summary":"On 26 August 2026 CISA added CVE-2015-5287 to its list of vulnerabilities being used in attacks. The flaw is in the Automatic Bug Reporting Tool (ABRT), the crash reporter shipped with Red Hat Enterprise Linux and related distributions. Its crash-dump handler mishandled symbolic links in the /var/spool/abrt directory, so someone who already has a low-privilege account on a machine can redirect file writes and gain full control. It is not a way in from the internet, but it turns a small foothold into a complete takeover. Red Hat's page lists a CVSS v2 score of 6.9; CISA cites 7.8 from NVD. Red Hat released updated abrt and libreport packages years ago (CentOS 7 advisory CESA-2015:2505). A secondary report says RHEL 6 and 7 and derivatives were affected, but Red Hat's page did not list affected products or fixed versions, and CISA warns the product may be end-of-life. No campaign, attacker or victim has been named in the reports we found. A public exploit module exists.","action":"If you run Red Hat, CentOS, Oracle Linux or Fedora servers, install the latest abrt and libreport updates from your distribution, or remove ABRT where crash reporting isn't needed. Move any machine whose operating system no longer gets updates to a supported one, and ask your IT provider to check.","product":"Red Hat Automatic Bug Reporting Tool (ABRT) on RHEL, CentOS and related Linux","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2015-5287"],"tags":["red-hat","abrt","linux","privilege-escalation","cisa-kev","rhel","centos","end-of-life"],"affected":["Red Hat Enterprise Linux 6 and 7 and derivatives such as CentOS 6/7 and Oracle Linux, and Fedora releases from around 2015 (per a secondary report; Red Hat's page lists no products)"],"fixed":["Updated abrt and libreport packages (CentOS 7 advisory CESA-2015:2505); version numbers not confirmed from Red Hat's page"],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2015-5287","url":"https://access.redhat.com/security/cve/cve-2015-5287","by":"Red Hat","date":"2026-08-26"},{"kind":"news","title":"Actively exploited Red Hat ABRT local privilege escalation hits CISA KEV: detection, hardening and EOL remediation guide","url":"https://securityarsenal.com/blog/actively-exploited-red-hat-abrt-local-privilege-escalation-hits-cisa-kev-detection-hardening-and-eol-remediation-guide","by":"Security Arsenal","date":"2026-08-26"}],"started":"2026-08-26","closed":"2026-08-26","created":"2026-11-03T22:10:44.878Z","updated":"2026-11-03T22:10:44.878Z","cve_notes":[{"cve":"CVE-2015-5287","name":"Symlink privilege escalation in Red Hat ABRT","what":"ABRT, Red Hat's crash reporter, mishandled symbolic links when writing crash dumps to /var/spool/abrt, so a local user with write access to a problem directory could gain higher privileges and take over the machine.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-08-26","added":"2026-11-03T22:09:50.672Z","kind":"cisa-added","text":"CISA added CVE-2015-5287 to its list of flaws being used in attacks on 26 August 2026, with a federal remediation deadline reported as 9 September 2026. The reports we read name no campaign, attacker or victim.","url":"https://securityarsenal.com/blog/actively-exploited-red-hat-abrt-local-privilege-escalation-hits-cisa-kev-detection-hardening-and-eol-remediation-guide","by":"Security Arsenal","patch":"partial"},{"at":"2026-08-26","added":"2026-11-03T22:09:50.672Z","kind":"disclosed","text":"Red Hat's CVE page describes CVE-2015-5287: the crash-dump handler in ABRT mishandled symbolic links when writing to /var/spool/abrt, letting a local user with write access to a problem directory gain higher privileges. It was reported by Philip Pettersson of Samsung, and the page carries no publication date.","url":"https://access.redhat.com/security/cve/cve-2015-5287","by":"Red Hat","patch":null}],"url":"https://hard.fyi/live/redhat-abrt-symlink-privilege-escalation-aug-2026/","json":"https://hard.fyi/api/live?id=redhat-abrt-symlink-privilege-escalation-aug-2026"}