On August 26, 2026, CISA added CVE-2015-3246 — a race condition vulnerability in Red Hat's libuser library — to its Known Exploited Vulnerabilities (KEV) catalog, confirming that this flaw is being actively exploited in the wild right now. This is not a historical footnote. When CISA places a vulnerability on the KEV, it means threat actors are using it against real targets today, and every unmanaged or unpatched Linux estate running vulnerable libuser builds is exposed.
The vulnerability allows an authenticated local user to corrupt the /etc/passwd file, resulting in denial of service or, more critically, unauthorized privilege escalation to root. In practical terms: any low-privileged foothold an attacker gains on a vulnerable Red Hat-derived system — via a compromised service account, a web shell, a phished SSH credential, or a malicious insider — can be converted into full root control of the host. That makes this a classic privilege-escalation multiplier in modern intrusion chains, which is almost certainly why it is seeing renewed exploitation more than a decade after disclosure.
Under CISA's Binding Operational Directive (BOD) 26-04, federal civilian agencies are required to remediate KEV-listed vulnerabilities on defined timelines, with explicit guidance to apply vendor mitigations, follow CISA's Forensics Triage Requirements, or discontinue use of the product where mitigations are unavailable. Even if you are not bound by BOD 26-04, the KEV listing is your signal: treat this as an emergency patch event, not a routine maintenance item.
Technical Analysis
What is libuser?
libuser is a Red Hat-maintained library and toolset for user and group account management. It ships with a family of command-line utilities — most notably luseradd, luserdel, lusermod, lchfn (change finger information), and lchsh (change login shell) — several of which are installed setuid root so unprivileged users can modify their own account attributes. That setuid posture is exactly what makes a flaw in libuser so dangerous: the vulnerable code executes with root privileges on behalf of any local user.
The vulnerability (CVE-2015-3246)
The flaw is a race condition in how libuser's setuid helper programs handle updates to /etc/passwd. The utilities perform user-record modifications in a way that does not safely synchronize file access. A local attacker who can precisely time concurrent invocations of a setuid libuser binary (such as lchfn) against file-state changes can win the race and cause the process to write attacker-influenced or corrupted content into /etc/passwd while running as root.
Exploitation requirements, from a defender's perspective:
- Local authenticated access is required. This is not remotely exploitable on its own. It is the second stage of an intrusion — the step that turns an initial foothold into root.
- The attacker must be able to execute setuid libuser binaries and control timing of repeated invocations (typically via a tight loop in a shell script or a small compiled helper).
- The target host must be running a vulnerable libuser build. The flaw affected libuser versions shipped with Red Hat Enterprise Linux 6 and 7 era systems prior to the patched releases (RHEL 6: fixed in
libuser-0.56.13-8.el6_7; RHEL 7: fixed inlibuser-0.60-7.el7_1). Derivative distributions (CentOS, Oracle Linux, Scientific Linux) of the same vintages were equally affected.
A successful exploit can overwrite or corrupt entries in /etc/passwd — for example, altering the UID field of an attacker-controlled account to 0 (root-equivalent), blanking a password field, or mangling the file badly enough to break authentication entirely (denial of service against every account on the box).
Why is a 2015 CVE being exploited in 2026?
This is the uncomfortable reality of enterprise Linux: long-tail legacy systems. RHEL 6 and 7 era hosts persist in manufacturing floors, hospital device networks, lab environments, embedded appliance images, and "if it ain't broke" production servers that escaped patch governance. Attackers know this. A reliable local privilege escalation (LPE) with a well-documented race condition is a perfect pairing for any 2026 intrusion where the actor has landed on an old Linux host via credential theft or an internet-facing service exploit. The KEV listing confirms actors are doing exactly that.
Exploitation status
- CISA KEV: Added 2026-08-26 — confirmed active exploitation.
- Public research: The flaw was originally disclosed by Qualys in 2015 with technical write-ups and proof-of-concept methodology publicly available for years, meaning exploit maturity is high and reimplementation is trivial.
- Required action (per CISA): Apply vendor mitigations, comply with BOD 26-04 Prioritizing Security Updates Based on Risk, follow CISA's Forensics Triage Requirements, and for cloud services follow applicable BOD 26-04 guidance — or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and compensating controls.
Detection & Response
The good news: this exploit has loud, observable behavior. Winning a race condition requires hammering the target — dozens to thousands of rapid invocations of lchfn/lchsh/luseradd in tight succession, followed by writes to /etc/passwd. Both halves of that chain are detectable with auditd, EDR, or centralized syslog.
Key observables to hunt:
- High-frequency execution of setuid libuser binaries (
lchfn,lchsh,luseradd,lusermod) by non-root users — especially in bursts. - Unexpected modifications to
/etc/passwd,/etc/shadow, or/etc/groupoutside of legitimate account provisioning windows. - Accounts with UID 0 that are not
root, or malformed/corrupted entries in/etc/passwd— post-exploitation artifacts.
Sigma Rules
---
title: Suspicious Burst Execution of setuid libuser Binaries
description: Detects rapid or repeated invocation of setuid libuser utilities (lchfn, lchsh, luseradd, lusermod) by non-root users, consistent with CVE-2015-3246 race condition exploitation attempts against /etc/passwd.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246
- https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/08/27
status: experimental
logsource:
product: linux
category: process_creation
detection:
selection_img:
Image|endswith:
- '/lchfn'
- '/lchsh'
- '/luseradd'
- '/lusermod'
filter_root:
User: 'root'
condition: selection_img and not filter_root
falsepositives:
- Legitimate users updating their GECOS/finger information or login shell (typically single, infrequent invocations)
- Configuration management tools invoking luseradd/lusermod (tune by service account and parent process)
level: high
---
title: Direct Modification of Linux Authentication Database Files
description: Detects write or attribute-change activity on /etc/passwd, /etc/shadow, or /etc/group by processes other than standard account management tooling, indicative of corruption caused by CVE-2015-3246 exploitation or post-exploitation account manipulation.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246
- https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/08/27
status: experimental
logsource:
product: linux
category: file_event
detection:
selection_target:
TargetFilename:
- '/etc/passwd'
- '/etc/shadow'
- '/etc/group'
filter_legit_img:
Image|endswith:
- '/useradd'
- '/usermod'
- '/userdel'
- '/groupadd'
- '/groupmod'
- '/passwd'
- '/chpasswd'
- '/adduser'
- '/sshd'
- '/ansible'
- '/puppet-agent'
- '/cf-agent'
condition: selection_target and not filter_legit_img
falsepositives:
- Identity management agents (SSSD, AD integration tooling) and custom provisioning scripts — tune the filter to your environment's sanctioned tooling
level: high
Microsoft Sentinel / Defender KQL
This hunt assumes Linux syslog/auditd telemetry is flowing into Sentinel (via the Syslog or CEF connector, or via Defender for Endpoint on Linux). It looks for burst executions of libuser setuid binaries and authentication-database tampering.
// Hunt 1: Burst execution of setuid libuser binaries by non-root users
let lookback = 7d;
Syslog
| where TimeGenerated > ago(lookback)
| where ProcessName has_any ("lchfn", "lchsh", "luseradd", "lusermod")
| extend RealUser = coalesce(column_ifexists("EffectiveUserName", ""), HostUserName)
| summarize InvocationCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by Computer, ProcessName, RealUser, bin(TimeGenerated, 5m)
| where InvocationCount >= 10 // race-condition attempts require rapid repeated invocations
| order by InvocationCount desc;
// Hunt 2: auditd-style file integrity events on authentication databases
SecurityEvent
| where TimeGenerated > ago(lookback)
// extend with your auditd ingestion mapping if applicable
| where CommandLine has_any ("/etc/passwd", "/etc/shadow", "/etc/group")
| where Process !in ("useradd", "usermod", "userdel", "passwd", "chpasswd", "groupadd")
| project TimeGenerated, Computer, Account, Process, CommandLine, Activity
| order by TimeGenerated desc;
// Hunt 3: Post-exploitation artifact — processes running under UID 0 accounts that are not 'root'
Syslog
| where TimeGenerated > ago(lookback)
| where SyslogMessage has "uid=0" and SyslogMessage !has "user=root" and SyslogMessage !has "auid=0"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;
Velociraptor VQL
For live response on suspected Linux hosts, this artifact checks for active libuser hammering and captures the integrity state of the authentication databases. Note that on Linux clients you would typically deploy this via Velociraptor's Linux support; the glob and stat approach works cross-platform.
-- CVE-2015-3246 triage: libuser abuse and /etc/passwd integrity
-- 1) Running processes invoking setuid libuser utilities
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(lchfn|lchsh|luseradd|lusermod)$'
OR CommandLine =~ '(lchfn|lchsh|luseradd|lusermod)'
-- 2) Integrity snapshot of authentication databases (mtime + hash for diffing against known-good)
SELECT FullPath, Mtime, Size, hash(path=FullPath) AS Hash
FROM glob(globs=['/etc/passwd', '/etc/shadow', '/etc/group'])
-- 3) Non-root accounts with UID 0 — the classic post-exploitation artifact
SELECT * FROM parse_file(filename='/etc/passwd', accessor='data')
WHERE line =~ '^[^:]+:[^:]*:0:' AND NOT line =~ '^root:'
(For the third query, if your Velociraptor deployment lacks a line-oriented parser for flat files, substitute a read_file() + regex approach or pull /etc/passwd back for offline analysis.)
Bash Verification and Remediation Script
Run this on every RHEL/CentOS/Oracle Linux host in scope — especially legacy 6/7-era systems. It reports the installed libuser version, flags vulnerable builds, applies the update, optionally strips the setuid bit as a compensating control, and checks for UID-0 backdoor accounts.
#!/bin/bash
# CVE-2015-3246 libuser verification & remediation script — Security Arsenal
# Run as root. Test in a staging environment first.
set -u
echo "=== [1] Installed libuser version ==="
rpm -q libuser || { echo "libuser not installed — host not affected by this CVE."; }
echo "=== [2] Checking for vulnerable builds (RHEL6 < 0.56.13-8.el6_7, RHEL7 < 0.60-7.el7_1) ==="
INSTALLED=$(rpm -q --queryformat '%{VERSION}-%{RELEASE}' libuser 2>/dev/null || echo "none")
echo "Installed: ${INSTALLED}"
echo "=== [3] Attempting vendor patch via yum ==="
yum -y update libuser && echo "libuser updated successfully." || echo "WARNING: update failed — repository may be unavailable (EOL system?). Apply compensating controls below."
echo "=== [4] Compensating control: remove setuid bit from libuser helpers (breaks lchfn/lchsh self-service) ==="
# Only uncomment if the host cannot be patched. Users will lose the ability to self-change shell/GECOS.
# chmod u-s /usr/bin/lchfn /usr/bin/lchsh 2>/dev/null && echo "setuid removed from lchfn/lchsh."
echo "=== [5] Post-exploitation check: non-root accounts with UID 0 ==="
awk -F: '$3 == 0 && $1 != "root" {print "ALERT: UID-0 account ->", $0}' /etc/passwd
echo "=== [6] Post-exploitation check: recent /etc/passwd modifications ==="
stat -c '%n last modified: %y' /etc/passwd /etc/shadow /etc/group
echo "=== [7] Burst-execution evidence in audit logs (if auditd enabled) ==="
ausearch -x lchfn -ts recent 2>/dev/null | tail -n 20
ausearch -x lchsh -ts recent 2>/dev/null | tail -n 20
echo "=== Done. If alerts were raised in steps 5-7, isolate the host and begin IR per CISA Forensics Triage Requirements. ==="
Remediation
1. Patch immediately — treat as an emergency change.
- RHEL 6: update to
libuser-0.56.13-8.el6_7or later. - RHEL 7: update to
libuser-0.60-7.el7_1or later. - CentOS / Oracle Linux / other RHEL derivatives of those vintages: apply the equivalent errata packages from your distribution's repositories.
- Vendor advisory: Red Hat Security Advisory covering CVE-2015-3246 (RHSA-2015:1482 / RHSA-2015:1483) — see access.redhat.com/security/cve/CVE-2015-3246.
- CISA KEV entry and required-action detail: CISA KEV Catalog.
2. If patching is impossible (EOL systems, frozen appliances), apply compensating controls:
- Remove the setuid bit from
lchfnandlchsh(chmod u-s). This eliminates the privilege-escalation vector at the cost of users losing self-service shell/GECOS changes — an acceptable trade on a host under active threat. - Restrict local interactive/logon access to the minimum necessary accounts; this CVE requires an authenticated local session, so account hygiene directly shrinks the attack surface.
- Enforce file integrity monitoring (AIDE, Tripwire, or auditd watches) on
/etc/passwd,/etc/shadow, and/etc/group.
3. Comply with BOD 26-04 and CISA's Forensics Triage Requirements. Federal civilian agencies must remediate per the KEV due date, follow the Forensics Triage Requirements before wiping or rebuilding any potentially compromised asset, and apply the cloud-service guidance where applicable. If mitigations are genuinely unavailable for an asset, CISA's directive is explicit: discontinue use of the product.
4. Evaluate internet exposure per asset. While CVE-2015-3246 is a local-only flaw, its real-world value to attackers is as a post-compromise escalation step. Any internet-facing legacy RHEL/CentOS host running vulnerable libuser is one exploited web service away from full root compromise. Prioritize externally reachable and DMZ systems first, then internal infrastructure, then endpoints.
5. Hunt before you patch. Because exploitation is confirmed in the wild, assume some hosts may already be compromised. Run the detections above — especially the UID-0 account check and the libuser burst-execution hunt — before remediation wipes the forensic evidence. A patched but backdoored host is still a breached host.
6. Fix the systemic problem. A 2015 LPE landing on the KEV in 2026 is an indictment of asset inventory and legacy lifecycle management, not just patching. Identify every RHEL 6/7-era system in your estate, and build the business case to migrate, isolate, or retire it. The next KEV resurrection of a decade-old Linux LPE is already in an attacker's toolkit.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.