Red Hat ABRT privilege escalation CVE-2015-5287, a 2015 bug, added to CISA's exploited list
CISA says attackers are using CVE-2015-5287, an old flaw in Red Hat's crash reporter ABRT that lets a local user become root. It matters on RHEL/CentOS 6 and 7 servers. Install the abrt and libreport updates, or remove ABRT, and retire unsupported systems.
If you run Red Hat, CentOS, Oracle Linux or Fedora servers, install the latest abrt and libreport updates from your distribution, or remove ABRT where crash reporting isn't needed. Move any machine whose operating system no longer gets updates to a supported one, and ask your IT provider to check.
What’s happening
On 26 August 2026 CISA added CVE-2015-5287 to its list of vulnerabilities being used in attacks. The flaw is in the Automatic Bug Reporting Tool (ABRT), the crash reporter shipped with Red Hat Enterprise Linux and related distributions. Its crash-dump handler mishandled symbolic links in the /var/spool/abrt directory, so someone who already has a low-privilege account on a machine can redirect file writes and gain full control. It is not a way in from the internet, but it turns a small foothold into a complete takeover. Red Hat's page lists a CVSS v2 score of 6.9; CISA cites 7.8 from NVD. Red Hat released updated abrt and libreport packages years ago (CentOS 7 advisory CESA-2015:2505). A secondary report says RHEL 6 and 7 and derivatives were affected, but Red Hat's page did not list affected products or fixed versions, and CISA warns the product may be end-of-life. No campaign, attacker or victim has been named in the reports we found. A public exploit module exists.
- What
- Flaw
- Affects
- Red Hat Automatic Bug Reporting Tool (ABRT) on RHEL, CentOS and related Linux
- Affected
- Red Hat Enterprise Linux 6 and 7 and derivatives such as CentOS 6/7 and Oracle Linux, and Fedora releases from around 2015 (per a secondary report; Red Hat's page lists no products)
- Fixed in
- Updated abrt and libreport packages (CentOS 7 advisory CESA-2015:2505); version numbers not confirmed from Red Hat's page
- Since
- 26 Aug 2026
- Closed
- 26 Aug 2026
Timeline
- CISA addedPartly fixed
CISA added CVE-2015-5287 to its list of flaws being used in attacks on 26 August 2026, with a federal remediation deadline reported as 9 September 2026. The reports we read name no campaign, attacker or victim.
- Made public
Red Hat's CVE page describes CVE-2015-5287: the crash-dump handler in ABRT mishandled symbolic links when writing to /var/spool/abrt, letting a local user with write access to a problem directory gain higher privileges. It was reported by Philip Pettersson of Samsung, and the page carries no publication date.
Sources
- CVE-2015-5287Red Hat · 26 Aug 2026
- Actively exploited Red Hat ABRT local privilege escalation hits CISA KEV: detection, hardening and EOL remediation guideSecurity Arsenal · 26 Aug 2026