SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
6 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2015-5287 · CVSS 7.8

Red Hat Automatic Bug Reporting Tool: attackers can gain admin rights

AFFECTSRed Hat Automatic Bug Reporting Tool

OFFICIAL NAME: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

WHAT IT IS · COMPUTERS, PHONES AND BROWSERSIt runs on staff computers, phones or browsers.

DO THIS FIRSTInstall the latest updates on every device, and turn on automatic updates. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

WHY THIS VERDICT Attacks are confirmed. Ready-made attack tools are public.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. CISA Vulnrichment marks CVE-2015-5287 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2015-5287 published
  2. EXPLOIT CODE PUBLIC
    Exploit-DB
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 3915 days after disclosure. CISA listed it 3915 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Sep 9, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. NOV 22, 2015
    Metasploit exploit module: ABRT sosreport Privilege Escalation
  2. NOV 30, 2015
    Exploit-DB entry: RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
  3. NOV 30, 2015
    Exploit-DB entry: abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
  4. Attack activity. DEC 7, 2015
    CISA Vulnrichment marks CVE-2015-5287 as actively exploited
  5. SEP 24, 2019
    Exploit-DB entry: ABRT - sosreport Privilege Escalation (Metasploit)
  6. Attack activity. AUG 25, 2026
    Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

SOURCES

  1. [1] CISA Known Exploited Vulnerabilities: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability, AUG 25
  2. [2] Exploit-DB: Exploit-DB entry: ABRT - sosreport Privilege Escalation (Metasploit), SEP 24
  3. [3] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2015-5287 as actively exploited, DEC 7
  4. [4] Exploit-DB: Exploit-DB entry: RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation, NOV 30
  5. [5] Exploit-DB: Exploit-DB entry: abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation, NOV 30
  6. [6] Metasploit module metadata: Metasploit exploit module: ABRT sosreport Privilege Escalation, NOV 22