What happened
CISA added CVE-2015-3246 to the Known Exploited Vulnerabilities catalog on August 26, 2026. NVD’s record republishes CISA’s fields verbatim: cisaExploitAdd of 2026-08-26, cisaActionDue of 2026-09-09, and cisaVulnerabilityName of “Red Hat Libuser Race Condition Vulnerability.” Federal civilian agencies have until September 9, 2026.
What changed four days ago is the federal obligation. The vulnerability was published on August 11, 2015. What makes it worth reading now is that the score most vulnerability tools will show for it describes a different, and far less serious, vulnerability than the one Red Hat, the original researchers, CISA, and a Metasploit module all describe.
NVD’s description reads: “libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification.” Denial of service. Nothing about privileges.
The scoring is where it gets awkward. NVD’s record carries exactly two metrics entries, and they are not the same kind of thing. The CVSS v3.1 entry is secondary, sourced to 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Red Hat’s CNA identifier — at 5.1 medium, vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. Read that vector: confidentiality none, integrity none, availability high. It says this bug cannot read anything and cannot change anything. There is no CVSS v3 primary from [email protected] at all. The only NVD primary entry on the record is a CVSS v2.0 score of 7.2, vector AV:L/AC:L/Au:N/C:C/I:C/A:C — complete confidentiality, complete integrity, complete availability impact. The record is listed as “Analyzed.” Its weaknesses are CWE-264 as primary and CWE-367, time-of-check to time-of-use, as secondary.
So the same government record contains a 2015-era score saying total system compromise and a modern score saying availability-only, with no modern score from NVD itself to arbitrate. Almost every scanner, ticketing integration, and risk dashboard built in the last decade surfaces the v3 number.
Everyone who has looked at the bug directly says it yields root.
Red Hat’s own page for the CVE rates it Important and describes it this way: “A flaw was found in the way the libuser library handled the /etc/passwd file. A local attacker could use an application compiled against libuser (for example, userhelper) to manipulate the /etc/passwd file, which could result in a denial of service or possibly allow the attacker to escalate their privileges to root.” Red Hat’s own CVSS v2 base score is 6.8.
Qualys, which disclosed the issue in July 2015 alongside CVE-2015-3245, was explicit about which half of the pair carried the impact. In its advisory, CVE-2015-3245 on its own is a local denial of service; CVE-2015-3246 is the one Qualys turned into a local root exploit against userhelper. CISA added CVE-2015-3246 and left CVE-2015-3245 off the catalog, which matches the research. The catalog got the selection right and inherited a description that got the impact wrong.
A packaged exploit has been public for eight years. Exploit-DB entry 44633, “Libuser – ‘roothelper’ Local Privilege Escalation (Metasploit),” dated May 16, 2018, credits Brendan Coles working from the Qualys research. It inserts a UID 0 account into /etc/passwd and lists tested targets across CentOS 6.0 through 7.1, Fedora 13 through 22, and Red Hat 6.6 through 7.0. It requires the current user’s password.
The exploitation evidence behind the KEV addition is a single vendor’s research. Cisco Talos published a report on August 20, 2026 on an actor it tracks as UAT-10147, which it characterizes as a “Chinese-speaking cybercrime group.” That report names this CVE directly: “CVE-2015-3246 abuses a flaw in libuser’s roothelper component, where improper file handling allows a local attacker to corrupt the ‘/etc/passwd’ file and gain root-level access.” Talos names six Linux local privilege escalation vulnerabilities in the actor’s post-compromise toolkit. Three of them — this one, CVE-2015-5287 in Red Hat’s Automatic Bug Reporting Tool, and CVE-2022-0995 in the Linux kernel’s watch_queue subsystem — were added to KEV on August 26, 2026 with the same September 9 deadline. The other three were already listed: CVE-2021-3156 since April 6, 2022 and CVE-2022-0847 since April 25, 2022, with CVE-2010-3904 the remaining name.
Counting the initial-access side, that single August 20 report accounts for four of the six vulnerabilities CISA added on August 26. The fourth is CVE-2021-23758 in AjaxPro, whose record has problems of its own. The two additions that do not trace to Talos are the Citrix NetScaler flaw and a 2019 Microsoft SQL Server bug.
Why it matters
A federal deadline is a queue-ordering instruction, and the queue is ordered by score. An agency or a company that pulls this CVE into a sprint sees 5.1, medium, availability-only, and a 2015 publication date. Nothing in the v3 vector suggests that clearing it is urgent, because the vector explicitly states the flaw cannot compromise confidentiality or integrity. The entry that says otherwise is a CVSS v2 score, and v2 has been formally superseded for so long that a great deal of tooling neither displays it nor lets you sort on it.
This is a specific failure mode worth naming: a CVE old enough to have been scored under v2 by NVD, then scored under v3 only by its CNA, ends up with its most authoritative modern number supplied by a party that scored a narrower reading of the flaw. NVD’s own backfill never reached it. The result is not a disputed score in the ordinary sense, where two parties assess the same behavior differently. It is a record where the two numbers are describing different vulnerabilities and nothing on the page says so.
The catalog listing partially repairs this, which is the argument for KEV mattering more than severity. But the repair is incomplete, because CISA’s required action is the standard text and carries no impact information. An operator who reads the KEV entry, then clicks through to the CVE to understand what they are fixing, lands on the denial-of-service description and the 5.1.
The provenance is also worth stating plainly, because it is unusual. Four of six additions in one batch resting on one vendor’s report is not a criticism of the report — Talos names the CVEs, quotes the mechanism, and the underlying exploits are old and public, so nothing here is speculative. It is a statement about concentration. There is currently no second vendor’s telemetry in public confirming that this specific 2015 flaw is being exploited in 2026. That is the sourcing an agency is acting on, and it should be visible in the ticket rather than implied by the catalog’s authority.
What to do
Fixed packages are libuser 0.56.13-8 or later on the 0.56 line and 0.60-7 or later on the 0.60 line, shipped in RHSA-2015-1482 and RHSA-2015-1483. Any supported Red Hat Enterprise Linux, CentOS, or Fedora build patched since late 2015 already carries them.
The exposure is old systems, and Red Hat says so directly: it lists the RHEL 5 packages as not currently planned to be addressed in future updates. If you are running RHEL 5 or a derivative of that vintage — and the reason this bug is in an active toolkit is that such systems are still reachable — there is no vendor fix coming. Removing the setuid bit from /usr/sbin/userhelper, or removing the usermode package where nothing depends on it, closes the path that the public exploit uses.
Check what actually calls libuser rather than assuming the library alone is the risk. The exploit path runs through userhelper in the usermode package; that binary being setuid root is what turns file corruption into privilege escalation.
For detection, the public exploit writes a UID 0 entry into /etc/passwd. Alert on new accounts with UID 0 and on unexpected modifications to /etc/passwd. That is a cheap rule and it covers the packaged technique directly. Because this is a local privilege escalation, it also implies something upstream already went wrong — treat a hit as post-compromise activity and look for the initial access, not just the escalation.
If you are triaging by score, override this one. The 5.1 is not describing what the exploit does.
Sourcing note
KEV dates come from NVD’s record for CVE-2015-3246, which republishes CISA’s cisaExploitAdd, cisaActionDue and cisaVulnerabilityName fields. CISA’s catalog pages return 403 to automated fetching, so the catalog was not read directly; the values here are NIST’s republication, and the August 26 batch was cross-checked against a third-party KEV mirror and against the individual NVD records for each CVE named. Metrics, weakness identifiers, and reference lists were read from NVD; the CVE-2015-3245 record was checked and confirmed to carry no CISA fields. Red Hat’s description, severity rating and lifecycle statement come from its own CVE page. The Qualys advisory of July 2015 was read for the division of impact between the two CVEs. The Metasploit module details come from Exploit-DB entry 44633. Exploitation is single-sourced to Cisco Talos’s August 20, 2026 report on UAT-10147; we found no independent corroboration.
One inconsistency we could not resolve: NVD’s reference lists for CVE-2015-3246, CVE-2015-5287 and CVE-2021-23758 all carry the Talos report, but the reference list for CVE-2022-0995 — added the same day, named in the same report — does not. We do not know whether that is a backfill lag or a deliberate difference. Also unresolved is whether NVD intends to add a v3 primary score to a record whose only modern score comes from the CNA and reads availability-only.