Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-09. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 3 products
| Date | Total | Labels |
|---|
| 2026-08-26 | 2 | Active Exploitation1Exploit1 |
| 2026-08-27 | 3 | Active Exploitation2Disclosure1 |
| 2026-08-28 | 1 | Active Exploitation1 |
| 2026-08-30 | 1 | Exploit1 |
| 2026-09-28 | 1 | Active Exploitation1 |
CVE-2015-3246: Red Hat Libuser Race Condition Vulnerability CVSS 7.8 · EPSS 7.1% · 15 public exploits https://notcve.org/cve/CVE-2015-3246 https://t.co/FIx8grIb88
Post summary
The tweet notes that CVE-2015-3246, a Red Hat Libuser race condition, has 15 publicly available exploits, offering evidence of exploit code but lacking patch information or indications of active in‑the‑wild attacks.
CISA's late-August KEV batch mixed a fresh Citrix NetScaler flaw (CVE-2026-8452) with a 2015 bug (CVE-2015-3246) still being exploited a decade later. Six CVEs, one lesson: patch debt doesn't expire. https://compliancehub.wiki/cisa-kev-august-2026-decade-old-cves-netscaler-vulnerability-debt-bod-26-04/ https://t.co/vTRaUM635g
Post summary
The text highlights that CISA's KEV batch includes a recent Citrix NetScaler flaw and a 2015 bug still being actively exploited, underscoring that unpatched vulnerabilities remain a risk over time.
A libuser flaw on a federal clock scores 5.1 for denial of service. Red Hat, Qualys, and a Metasploit module all say it yields root. https://severitydaily.com/libuser-cve-2015-3246-kev-medium-score-root/
Post summary
The entry highlights CVE‑2015‑3246 as a denial‑of‑service flaw with potential root escalation, noting a available Metasploit module, yet it does not confirm active exploitation or provide patch info.
🚨 CISA alerte sur l’exploitation active de CVE-2015-3246 (libuser Red Hat). Entraîne un déni de service ou une élévation de privilèges vers root, avec échéance au 9 septembre 2026. #zoneantimalware https://zoneantimalware.com/cisa-red-hat-alerte/
Post summary
CISA warns of ongoing, active exploitation of CVE‑2015‑3246 in Red Hat, which can trigger DoS or privilege escalation to root, with a stated expiry of activity by September 9 2026.
🔵 libuser, Race Condition Vulnerability, #CVE-2015-3246 (Important) -DC-Aug2026-1943 https://dailycve.com/libuser-race-condition-vulnerability-cve-2015-3246-important-dc-aug2026-1943/
Post summary
The post is a brief notice of a race condition vulnerability in libuser (CVE-2015-3246), identified as Important, with a link to a dailycve article for more information.
🔒 #CyberSecurity CVE-2015-3246: Red Hat Libuser Race Condition Now Actively Exploited — CISA KEV… "On August 26, 2026, CISA added CVE-2015-3246 — a race condition vulnerability in Red…" 🔗 https://securityarsenal.com/blog/cve-2015-3246-red-hat-libuser-race-condition-now-actively-exploited-cisa-kev-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve20153246 #critical #cisakev
Post summary
CISA has flagged CVE-2015-3246 as a race-condition vulnerability in Red Hat Libuser that is actively exploited, with a remediation guide linked for detection and mitigation.
CISAが既知の悪用された脆弱性6件をカタログに追加 CISA Adds Six Known Exploited Vulnerabilities to Catalog #CISA (Aug 26) CVE-2015-3246 Red Hat Libuserの競合状態の脆弱性 CVE-2015-5287 Red Hat自動バグ報告ツールにおける権限昇格の脆弱性 CVE-2019-1068 Microsoft SQL Serverのリモートコード実行の脆弱性 CVE-2021-23758 http://Ajax.NET Professionalにおける信頼できないデータの逆シリアル化の脆弱性 CVE-2022-0995 Linuxカーネルの境界外書き込みの脆弱性 CVE-2026-8452 Citrix NetScaler ADCおよびNetScaler Gatewayにおけるメモリバッファの範囲内での操作の不適切な制限の脆弱性 https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
Post summary
CISA adds six CVEs to its catalog of known exploited vulnerabilities, listing their generic impact categories, but provides no PoC, exploit code, or patch guidance.
CISA adds 6 active exploits to KEV • CVE-2015-3246 — Red Hat Libuser • CVE-2015-5287 — Red Hat ABRT • CVE-2019-1068 — Microsoft SQL Server • CVE-2021-23758 — https://Ajax.NET Professional • CVE-2022-0995 — Linux Kernel • CVE-2026-8452 — Citrix NetScaler ADC/Gateway
Post summary
CISA announced six CVEs that are currently being actively exploited, adding them to the KEV list.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | libuser_project | libuser | - | - | - |
| OS | opensuse | opensuse | 13.2 | - | - |
| OS | redhat | enterprise_linux | 5.0 | - | - |
| OS | redhat | enterprise_linux | 6.0 | - | - |
| OS | redhat | enterprise_linux | 7.0 | - | - |