Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-09. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 7 products
| Date | Total | Labels |
|---|
| 2026-08-26 | 4 | Active Exploitation2Disclosure1General1 |
| 2026-08-27 | 2 | Active Exploitation2 |
| 2026-09-02 | 1 | Active Exploitation1 |
CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CVSS 7.8 · EPSS 3.4% · 18 public exploits https://notcve.org/cve/CVE-2015-5287 https://t.co/TUlAgET5tX
Post summary
The post reports CVE‑2015‑5287, noting its CVSS score and EPSS, and indicates 18 publicly available exploits, but lacks a PoC, detailed exploit code, active attack evidence, or patch information.
#CRITICAL CVE-2015-5287: Red Hat ABRT privilege escalation via symlink attack. CISA KEV-listed. Affected products likely EoL/EoS—discontinue use immediately. Local attackers can gain elevated privileges. #CVE #Vulnerability #PatchNow https://t.co/XmCDS0SiBS
Post summary
The tweet announces that CVE‑2015‑5287 is a critical privilege‑escalation flaw in Red Hat ABRT, noting its CISA KEV status and urging immediate discontinuation of affected products.
🔒 #CyberSecurity Actively Exploited Red Hat ABRT Local Privilege Escalation Hits CISA KEV — Dete… "On August 26, 2026, CISA added CVE-2015-5287 — a local privilege escalation…" 🔗 https://securityarsenal.com/blog/actively-exploited-red-hat-abrt-local-privilege-escalation-hits-cisa-kev-detection-hardening-and-eol-remediation-guide #CyberSecurity #ThreatIntel #cve20155287 #critical #cisakev
Post summary
The post reports that CVE‑2015‑5287, a local privilege escalation in Red Hat ABRT, is actively exploited in the wild and has been added to the CISA KEV list; no PoC, patch, or exploit code details are included in the excerpt.
CISAが既知の悪用された脆弱性6件をカタログに追加 CISA Adds Six Known Exploited Vulnerabilities to Catalog #CISA (Aug 26) CVE-2015-3246 Red Hat Libuserの競合状態の脆弱性 CVE-2015-5287 Red Hat自動バグ報告ツールにおける権限昇格の脆弱性 CVE-2019-1068 Microsoft SQL Serverのリモートコード実行の脆弱性 CVE-2021-23758 http://Ajax.NET Professionalにおける信頼できないデータの逆シリアル化の脆弱性 CVE-2022-0995 Linuxカーネルの境界外書き込みの脆弱性 CVE-2026-8452 Citrix NetScaler ADCおよびNetScaler Gatewayにおけるメモリバッファの範囲内での操作の不適切な制限の脆弱性 https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog
Post summary
CISA announced the addition of six CVEs that are known to be exploited in the wild, providing brief vulnerability details for each.
#CRITICAL CVE-2015-5287: Red Hat ABRT privilege escalation via symlink attack. CISA KEV-listed. Affected products likely EoL/EoS—discontinue use immediately. Local attackers can gain elevated privileges. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/gO4sctGkuw
Post summary
CISA has classified CVE‑2015‑5287 as a KEV, indicating it is actively exploited and users should immediately stop using the affected Red Hat ABRT components.
🛡️ CVE-2015-5287: Escalada de Privilegios en Red Hat ABRT mediante Ataque de Symlink Análisis técnico de CVE-2015-5287 en Red Hat ABRT: escalada de privilegios local mediante symlink attack. Puntuación CVSS 7.8 HIGH. Mitigaciones y referencias. https://www.ciberplaneta.org/vulnerabilidades/cve-2015-5287-escalada-de-privilegios-en-red-hat-abrt-mediante-ataque-de-symlink/ #ciberplaneta #vulnerabilidades #cve_2015_5287 #cve #vulnerabilidad #red_hat #seguridad #infosec #ciberseguridad
Post summary
The post provides a technical overview of CVE‑2015‑5287, detailing the local privilege escalation vector and CVSS score, but offers no PoC, exploitation evidence, or patch information.
CISA adds 6 active exploits to KEV • CVE-2015-3246 — Red Hat Libuser • CVE-2015-5287 — Red Hat ABRT • CVE-2019-1068 — Microsoft SQL Server • CVE-2021-23758 — https://Ajax.NET Professional • CVE-2022-0995 — Linux Kernel • CVE-2026-8452 — Citrix NetScaler ADC/Gateway
Post summary
CISA notes that six CVEs—affecting Red Hat, Microsoft SQL Server, Ajax.NET, Linux kernel, and Citrix NetScaler—are being actively exploited, but the post offers no PoC, exploit code, patch, or technical details.
8 of 8 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | oracle | linux | 7 | - | - |
| App | redhat | automatic_bug_reporting_tool | - | - | - |
| OS | redhat | enterprise_linux | 6.0 | - | - |
| OS | redhat | enterprise_linux | 7.0 | - | - |
| OS | redhat | enterprise_linux_desktop | 7.0 | - | - |
| OS | redhat | enterprise_linux_hpc_node | 7.0 | - | - |
| OS | redhat | enterprise_linux_server | 7.0 | - | - |
| OS | redhat | enterprise_linux_workstation | 7.0 | - | - |