Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2015-5287 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Year | 2015 |
| Publication Date | 2026-08-26 |
| Vendor | Red Hat |
| Product | Automatic Bug Reporting Tool (ABRT) |
| CVSS Score | 7.8 (High) |
| EPSS Score | 3.4% (percentile: 88%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Due Date | 2026-09-09 |
Vulnerability Description
Source: CISA KEV / NVD
The abrt-hook-ccpp helper program in the Automatic Bug Reporting Tool (ABRT) before version 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name — for example /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
The mechanism is classic: ABRT creates a dump file under a name the attacker can predict. By planting a symlink to a system file at that location, the attacker makes a privileged process write data somewhere it would not otherwise have access to.
CISA notes that the product may be end-of-life / end-of-service — in which case discontinuing use or transitioning to a supported version is the recommended path.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 “Prioritizing Security Updates Based on Risk” guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
In practice: update ABRT to 2.7.1 or later. On systems where ABRT is not needed — and on production servers it usually is not — consider disabling and removing the package. That is a more durable answer than another patch to a tool that serves no business function.
CISA’s deadline for US federal agencies: 2026-09-09.
Who Is Affected?
The vulnerability affects systems running Red Hat Automatic Bug Reporting Tool (ABRT) older than 2.7.1 — the tool is installed by default on RHEL, CentOS and Fedora, as well as derivatives such as Oracle Linux.
This mainly touches older RHEL/CentOS installations that still carry legacy systems — particularly CentOS 7, out of support but still found in production. Because this is a local vulnerability, the risk rises wherever a server hosts multiple user accounts or runs applications that permit code execution.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
