Actively Exploited Red Hat ABRT Local Privilege Escalation Hits CISA KEV — Detection, Hardening, and EoL Remediation Guide

On August 26, 2026, CISA added CVE-2015-5287 — a local privilege escalation vulnerability in the Red Hat Automatic Bug Reporting Tool (ABRT) — to the Known Exploited Vulnerabilities (KEV) catalog, confirming that this flaw is being actively exploited in the wild right now. This is not a historical footnote. When CISA KEV-flags a decade-old defect, it means threat actors have operationalized it against real targets — almost certainly as a post-compromise privilege escalation step on legacy, unpatched, and frequently end-of-life (EoL) RHEL and CentOS estates.

The vulnerability allows a local user with limited permissions to escalate privileges via a symlink attack on files with predictable names written by ABRT components. In practical terms: an attacker who gains an initial foothold as a low-privileged user — via web shell, compromised service account, or stolen credentials — can use this flaw to become root. That makes it a critical link in modern intrusion chains, even eleven years after disclosure.

CISA's required action is unambiguous: apply vendor mitigations in accordance with BOD 26-04 (Prioritizing Security Updates Based on Risk), and where products are EoL/EoS, discontinue use or transition to a supported version. If you run any legacy RHEL 6/7 or CentOS infrastructure — and most enterprises still have some lurking in labs, OT adjacencies, or forgotten appliances — this is an immediate action item.

Technical Analysis

Affected Products and Platforms

• Red Hat Automatic Bug Reporting Tool (ABRT) — the crash-reporting daemon suite (abrtd, abrt-hook-ccpp, associated utilities) shipped by default on:
  • Red Hat Enterprise Linux 6 and 7 (and derivative rebuilds: CentOS 6/7, Oracle Linux, Scientific Linux)
  • Fedora releases contemporary with the 2015 disclosure
• CISA explicitly warns that impacted products may be end-of-life and/or end-of-service. RHEL 6 reached end of Maintenance Support in November 2020 (ELS through June 2024); CentOS 6 and the standard CentOS 7 lifecycle have similarly concluded. Unmigrated systems are the prime exploitation surface.

How the Vulnerability Works (Defender's View)

ABRT components handle crash dumps and associated metadata files, historically using predictable filenames in world-writable or user-influenced paths (notably under /var/tmp/abrt/ and /var/spool/abrt/). The defect: ABRT fails to properly validate whether a target path is a symbolic link before writing to it with elevated privileges.

The attack chain from the defender's perspective:

1. Initial access (low privilege): Attacker lands on the host as an unprivileged user — web application RCE, a compromised daemon account, or a brute-forced SSH credential.
2. Symlink pre-positioning: The attacker creates a symbolic link at a predictable ABRT file path (e.g., within the dump directory) pointing at a sensitive root-owned target — /etc/passwd, /etc/sudoers, an SSH authorized_keys file, or a root-owned binary.
3. Trigger: A crash event (which the attacker can induce) causes the privileged ABRT component to write to the predictable filename — following the attacker's symlink and overwriting or modifying the root-owned target file.
4. Privilege escalation: The attacker converts the write primitive into root — adding a sudoers entry, planting an SSH key, or corrupting authentication files — and then establishes persistence.

Exploitation requires local access, which is precisely why KEV inclusion matters: this is a force multiplier in post-exploitation, not an initial-access vector. Expect it paired with internet-facing initial-access bugs on aging Linux estates.

Exploitation Status

• CISA KEV: Confirmed added 2026-08-26 — active exploitation verified.
• Nature of activity: Local privilege escalation observed as part of live intrusion activity.
• BOD 26-04: Federal agencies must remediate per the binding operational directive's KEV timeline; private-sector organizations should treat the same deadline as their SLA.

Detection & Response

The most reliable telemetry for this attack is threefold: (1) symlink creation in ABRT dump paths by non-root users, (2) privileged ABRT components spawning unexpected child processes or shells, and (3) unexpected modification of root-owned sensitive files (/etc/passwd, /etc/sudoers, /root/.ssh/authorized_keys). Tune these to your environment, but the symlink-creation signal in ABRT paths is high-fidelity — legitimate non-root symlink creation there is vanishingly rare.

---
title: Symlink Creation in ABRT Dump Directory by Non-Root User
id: 8f2c1b44-3d7e-4a91-b6c5-9e0f2a1d8c73
status: experimental
description: Detects symlink creation within ABRT dump directories by non-root accounts, consistent with CVE-2015-5287 symlink pre-positioning for local privilege escalation.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/var/tmp/abrt/'
      - '/var/spool/abrt/'
  selection_type:
    EventType: 'symlink'
  filter_root:
    User: 'root'
  condition: selection_paths and selection_type and not filter_root
falsepositives:
  - Rare; legitimate non-root symlink creation in ABRT dump paths is uncommon. Verify against crash-handler maintenance scripts.
level: high
---
title: ABRT Component Spawning Shell or Privilege Utility
id: 4b9e2d17-6c3a-4f58-a1d2-7e5b0c9f3a61
status: experimental
description: Detects ABRT daemon or hook processes spawning interactive shells or privilege-manipulation utilities, indicating successful exploitation of the ABRT symlink privilege escalation flaw.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'abrtd'
      - 'abrt-hook-ccpp'
      - 'abrt-action'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/chmod'
      - '/chown'
      - '/useradd'
      - '/usermod'
      - '/ssh-keygen'
      - '/visudo'
  condition: selection_parent and selection_child
falsepositives:
  - Custom ABRT event-action scripts configured by administrators to run post-crash remediation. Inventory and allowlist known abrt-action configurations.
level: critical
---
title: Suspicious Modification of Root-Owned Authentication Files on Linux
id: 2d7f4a93-8e1b-4c65-9f3a-5b8d1e6c0a29
status: experimental
description: Detects writes to critical root-owned authentication and privilege files potentially caused by a privileged ABRT process following an attacker-planted symlink (CVE-2015-5287).
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/08/28
tags:
  - attack.persistence
  - attack.t1098
  - attack.privilege_escalation
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename:
      - '/etc/passwd'
      - '/etc/shadow'
      - '/etc/sudoers'
      - '/root/.ssh/authorized_keys'
  filter_known_writers:
    Image|endswith:
      - '/useradd'
      - '/usermod'
      - '/passwd'
      - '/visudo'
      - '/sshd'
      - '/rpm'
      - '/yum'
      - '/dnf'
  condition: selection and not filter_known_writers
falsepositives:
  - Configuration management (Ansible, Puppet, Chef) writing these files outside standard package tooling — allowlist CM agent processes per environment.
level: high

For Microsoft Sentinel environments ingesting Linux syslog/audit data (via the Syslog or CEF connector, or AMA), the following hunt surfaces both symlink pre-positioning and ABRT-spawned shells across your fleet:

// Hunt: ABRT symlink privilege escalation behavior (CVE-2015-5287)
// Looks for symlink creation in ABRT dump paths and shells/tools spawned by ABRT components
let abrt_paths = dynamic(["/var/tmp/abrt/", "/var/spool/abrt/"]);
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(14d)
    | where ProcessName has_any ("abrtd", "abrt-hook-ccpp", "abrt-action")
    | where SyslogMessage has_any ("/bin/bash", "/bin/sh", "chmod", "chown", "useradd", "usermod", "visudo", "authorized_keys", "sudoers")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP),
    (CommonSecurityLog
    | where TimeGenerated > ago(14d)
    | where DeviceProcessName has_any ("ln", "abrt")
    | where Message has_any abrt_paths
    | where Message has "symlink"
    | project TimeGenerated, DeviceName, DeviceProcessName, SourceUserName, Message, SourceIP)
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by Computer, ProcessName, SyslogMessage
| order by LastSeen desc

For endpoint forensics at scale, Velociraptor can rapidly sweep your Linux fleet for pre-positioned symlinks in ABRT directories — the highest-fidelity artifact of staging activity — alongside running ABRT processes:

-- Hunt: ABRT dump directory symlinks and ABRT process execution (CVE-2015-5287)
-- Flags symlinks planted in ABRT dump paths and inventory of ABRT daemons/hooks
LET symlink_hunt = SELECT
    FullPath,
    Mtime,
    Mode,
    readlink(FullPath) AS LinkTarget
FROM glob(globs=['/var/tmp/abrt/**', '/var/spool/abrt/**'], accessor='file')
WHERE Mode.IsLink

LET abrt_procs = SELECT
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE Name =~ 'abrt' OR Exe =~ 'abrt'

SELECT * FROM symlink_hunt
UNION ALL
SELECT * FROM abrt_procs

Remediation

CISA's guidance for CVE-2015-5287 is explicit, and it should drive your remediation order of operations:

1. Inventory and isolate. Identify every host with abrt packages installed, prioritizing RHEL/CentOS 6/7 systems, EoL derivatives, and any host reachable from internet-facing services. Segregate EoL systems behind strict network ACLs while remediation proceeds.
2. Patch or mitigate per vendor instructions. Red Hat released updated abrt and libreport packages addressing the symlink handling defect (refer to the Red Hat Customer Portal advisory for CVE-2015-5287 and the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287). Apply updated packages via yum on supported systems.
3. Remove ABRT where crash reporting isn't required. On servers — especially EoL systems that cannot be patched — removing the abrt packages entirely eliminates the attack surface. Crash reporting is rarely justified on production servers.
4. Transition EoL/EoS systems. Per CISA's required action: if the OS itself is out of support, migrate workloads to a supported platform. Patching one CVE on an EoL OS leaves hundreds of others exposed. This KEV entry should be the business-case ammunition for that migration.
5. Meet BOD 26-04 timelines. Federal civilian agencies must remediate within the directive's KEV window; treat the same deadline as your internal SLA regardless of sector.

Use the following Bash script to assess exposure, hunt for planted symlinks, and remove or neuter ABRT on systems that cannot be immediately patched:

#!/bin/bash
# CVE-2015-5287 ABRT exposure assessment and mitigation
# Run as root. Review output before enabling the REMOVE_ABRT flag.

REMOVE_ABRT=false   # set true to uninstall ABRT packages

echo "=== [1] ABRT package inventory ==="
rpm -qa | grep -i -E '^abrt|^libreport' || echo "No ABRT packages installed."

echo "=== [2] ABRT service state ==="
for svc in abrtd abrt-ccpp abrt-oops abrt-vmcore; do
    systemctl is-enabled "$svc" 2>/dev/null | sed "s/^/$svc: /"
    systemctl is-active  "$svc" 2>/dev/null | sed "s/^/$svc: /"
done

echo "=== [3] Hunting for planted symlinks in ABRT dump paths ==="
find /var/tmp/abrt /var/spool/abrt -type l -ls 2>/dev/null || echo "No symlinks found (or directories absent)."

echo "=== [4] OS support status ==="
cat /etc/redhat-release 2>/dev/null
echo "Verify against Red Hat lifecycle: RHEL 6/7 and CentOS 6/7 are EoL/EoS - plan migration."

if [ "$REMOVE_ABRT" = true ]; then
    echo "=== [5] Disabling and removing ABRT ==="
    for svc in abrtd abrt-ccpp abrt-oops abrt-vmcore; do
        systemctl stop "$svc" 2>/dev/null
        systemctl disable "$svc" 2>/dev/null
    done
    yum -y remove abrt\* libreport\* 2>/dev/null || dnf -y remove abrt\* libreport\*
    echo "ABRT removed. Verify no dependent tooling required crash reporting."
else
    echo "=== [5] Removal skipped (REMOVE_ABRT=false) ==="
    echo "Interim hardening: restrict dump dir perms and monitor:"
    chmod 700 /var/tmp/abrt 2>/dev/null
    chmod 700 /var/spool/abrt 2>/dev/null
fi

echo "=== [6] Audit sensitive files for unexpected recent modification ==="
find /etc/passwd /etc/shadow /etc/sudoers /root/.ssh/authorized_keys -mtime -14 -ls 2>/dev/null

echo "Done. Correlate any symlink hits with IR procedures before cleanup."

Important IR caveat: if the symlink hunt in step 3 returns hits, do not simply delete them — treat the host as potentially compromised. Preserve the artifacts, capture volatile data, and pivot to a full root-compromise investigation (review /etc/passwd, /etc/sudoers, SSH keys, and persistence mechanisms for tampering). A planted symlink in an ABRT dump path is staging evidence of an in-progress privilege escalation.

Executive Takeaways

• KEV-listed means exploited. A 2015 CVE landing in the KEV in 2026 tells you attackers are systematically mining legacy Linux estates for escalation primitives. Your oldest servers are the target.
• EoL is the real vulnerability. CISA's guidance to discontinue EoL/EoS products is the durable fix. Use this KEV entry to force the migration conversation that keeps getting deferred.
• ABRT is removable. On most servers, crash-reporting daemons are unnecessary attack surface. Uninstalling abrt* is a clean, immediate risk elimination.
• Detect the staging, not just the exploit. Symlink creation in /var/tmp/abrt/ and /var/spool/abrt/ by non-root users is a high-fidelity, low-noise signal — deploy it fleet-wide today.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub