[HIGH PRIORITY] Red Hat ABRT Privilege Escalation (CVE-2015-5287)

⚠ HIGH PRIORITY — CISA KEV (Aug 26, 2026). CVE-2015-5287 is a privilege escalation in Red Hat Automatic Bug Reporting Tool (ABRT). Local users exploit predictable symlink paths to gain root — part of the UAT-10147 / BadIIS Linux privilege-escalation chain under active exploitation.

Affected systems

• Red Hat Enterprise Linux with ABRT before 2.7.1
• Fedora and CentOS derivatives with abrt package installed
• Legacy RHEL 7/8 servers still running abrtd service

Check if ABRT is installed

rpm -q abrt abrt-addon-ccpp 2>/dev/null
systemctl status abrtd 2>/dev/null
ls -la /var/spool/abrt/

Patching Method

1. Update ABRT/libreport packages: dnf update abrt libreport or yum update.
2. Preferred on RHEL 8+: disable and remove ABRT entirely (deprecated in RHEL 9).
3. systemctl disable --now abrtd abrt-journal-core abrt-oops abrt-xorg
4. dnf remove abrt* if crash reporting not required.
5. Use systemd-coredump as modern replacement on RHEL 9+.
6. Audit /var/spool/abrt for suspicious crash dumps and symlinks.
7. Review auth logs for privilege escalation after web-shell footholds.

systemctl disable --now abrtd.service
rpm -q abrt | grep -v 'not installed'

Until patched

• Disable abrtd immediately on internet-facing Linux web servers
• Limit local user shell access on compromised-class hosts
• Monitor for sosreport/abrt abuse in audit logs

CVSS: 7.8 High. Federal deadline: 09 Sep 2026.