CVE-2015-5287

CVE-2015-5287 is a privilege escalation flaw in Red Hat's Automatic Bug Reporting Tool (ABRT) in which a local user with certain permissions can gain elevated privileges via a symlink attack against a file with a predictable name. Exploitation requires local access to an affected system; an attacker who triggers the flawed file-handling behavior can elevate their privileges on that machine. It affects deployments running ABRT, which ships by default with Red Hat Enterprise Linux and related distributions, including systems that may now be end-of-life or end-of-service. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-26, indicating exploitation has been observed in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS estimates a 5.0% probability of exploitation within 30 days (92nd percentile).

What to do: Prioritize remediation per CISA BOD 26-04: inventory systems running ABRT (including EoL/EoS hosts), apply the updated abrt packages from Red Hat's security advisories, and migrate unsupported releases to a supported version. Where patching is not feasible, restrict local access to affected systems or disable/remove ABRT if it is not needed. Assess each asset's internet exposure and local user access, and triage per CISA's Forensics Triage Requirements.