libuser CVE-2015-3246: 2015 Linux Root Bug Lands in KEV

What to do

1. Find hosts that carry the vulnerable code: rpm -q libuser usermode (or dpkg -l libuser) across servers, golden images and appliances.
2. Update libuser to at least the RHSA-2015:1482/1483 builds (yum update libuser), or rebuild images from a maintained base.
3. Where you cannot update (RHEL 5, frozen appliances), apply Red Hat's mitigation: add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh.
4. Prioritize legacy internet-facing web servers: patch the web stack, or retire or isolate them, because a web foothold is what makes this local bug matter.
5. On the same hosts, check the other old root exploits Talos listed, such as sudo CVE-2021-3156 and Dirty Pipe CVE-2022-0847.

How to check if you are affected or compromised

• Check /etc/passwd for damage or additions: awk -F: '$3==0' /etc/passwd should list only root; diff it against /etc/passwd- and backups.
• Search /var/log/secure for chfn, chsh or userhelper activity by service accounts such as apache or nginx; the public exploit repeatedly rewrites the attacker's GECOS field.
• Hunt for the web shells and implants from the UAT-10147 campaign (BadIIS, QuasarRAT and others) using Talos's published IOCs, ClamAV signatures and Snort SIDs 1:66696 and 1:66697.

What happened#

On July 23, 2015, Qualys published an advisory on two bugs in libuser, the account-management library used by Red Hat-derived Linux distributions. Red Hat shipped fixes the same day. CVE-2015-3246 is a race in how libuser rewrites /etc/passwd: it edits the file in place instead of writing a temporary copy and renaming it, so a failed change can leave the file corrupted. Qualys turned it into a local root exploit against userhelper, "a setuid-root program from the usermode package," and, with some changes, against chfn. It called its proof of concept "our public roothelper.c". The companion bug CVE-2015-3245 lets newlines into the GECOS field. Red Hat rated 3246 Important and 3245 Moderate.

Eleven years later, on August 20, 2026, Cisco Talos described UAT-10147, a Chinese-speaking, financially motivated group running SEO fraud and data theft. Talos says the group leans on agentic AI to refine and validate exploits. It breaks into Windows and Linux web servers through one-day RCE bugs and then escalates with a kit of six Linux privilege-escalation exploits, CVE-2015-3246 among them. Talos found a target list of about 170,000 URLs and victims in government, education, media, technology and gaming. CISA added the CVE to the KEV catalog on August 26, 2026, with a September 9 federal deadline.

Who is affected#

The CVE record lists libuser before 0.56.13-8 and 0.60 before 0.60-7. Per the Red Hat article, every libuser shipped with RHEL 6 and 7 was affected until RHSA-2015:1482 (libuser-0.56.13-8.el6_7) and RHSA-2015:1483 (libuser-0.60-7.el7_1). RHEL 5 is affected and, per Red Hat's CVE page, will not be fixed. In 2015 Red Hat also flagged vulnerable copies in its container, cloud and appliance images. Ubuntu marks 18.04 through 24.10 as not affected, 16.04 as vulnerable and 14.04 as fixed through Ubuntu Pro. The Debian tracker lists bookworm and trixie as fixed.

Do you really need to act?#

For most teams, no. This is a local bug, and Red Hat notes the attacker needs an account listed in /etc/passwd and that account's password. LDAP-only accounts and system accounts without a valid password cannot use it. Any RHEL or CentOS 6 or 7 machine patched at any point since mid-2015 is fixed.

The KEV listing matters for one population: old Red Hat-family servers that nobody patches, especially web servers. In the Talos campaign, the web exploit gets the attacker in and these old privilege-escalation bugs turn that foothold into root. If you have such machines, this is the least of their problems. Treat the KEV entry as a prompt to find them.

What to do now#

1. Inventory: rpm -q libuser usermode on Red Hat-family hosts, dpkg -l libuser elsewhere, including golden images and vendor appliances.
2. Patch: yum update libuser, or rebuild from a maintained base image. Confirm the version is at least 0.56.13-8.el6_7 or 0.60-7.el7_1.
3. Cannot patch (RHEL 5, frozen appliances)? Apply Red Hat's mitigation by adding pam_warn.so and pam_deny.so rules to /etc/pam.d/chfn and /etc/pam.d/chsh. This blocks unprivileged use of chfn, chsh and the matching userhelper functions.
4. Fix the front door: patch, isolate or retire legacy internet-facing web servers.
5. Check the same hosts for the other old root bugs Talos lists, including sudo CVE-2021-3156 and Dirty Pipe CVE-2022-0847.

How to tell if you were hit#

Look at /etc/passwd first. awk -F: '$3==0' /etc/passwd should print only root. Diff the file against /etc/passwd- and your backups for new users, changed shells or mangled lines. The public exploit works by rewriting the attacker's GECOS field over and over, so search /var/log/secure for bursts of chfn, chsh or userhelper activity, especially from web service accounts. With the PAM mitigation in place, Red Hat says blocked attempts are logged there by default. Talos publishes ClamAV signatures, Snort SIDs 1:66696 and 1:66697, and an IOC list for the wider campaign. Use them to hunt for web shells and implants such as BadIIS and QuasarRAT. A host rooted this way should be rebuilt, not cleaned.

Timeline#

• Jul 23, 2015 — Qualys discloses CVE-2015-3245 and CVE-2015-3246, and Red Hat ships RHSA-2015:1482 and RHSA-2015:1483.
• Aug 11, 2015 — The CVE record is published.
• Aug 20, 2026 — Cisco Talos reports UAT-10147 using CVE-2015-3246 for Linux privilege escalation.
• Aug 26, 2026 — CISA adds CVE-2015-3246 to KEV, with a federal due date of September 9.

Vulnerability records

• CVE-2015-3246 · KEV 2026-08-26 · libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Red Hat — libuser vulnerabilities (CVE-2015-3245 and CVE-2015-3246) access.redhat.com
2. Qualys — Security advisory CVE-2015-3245 / CVE-2015-3246 qualys.com
3. Red Hat — RHSA-2015:1482 libuser security update (RHEL 6) access.redhat.com
4. Red Hat — RHSA-2015:1483 libuser security update (RHEL 7) access.redhat.com
5. Red Hat — CVE-2015-3246 access.redhat.com
6. CVE record — CVE-2015-3246 cve.org
7. CISA — Known Exploited Vulnerabilities: CVE-2015-3246 cisa.gov
8. Cisco Talos — UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations blog.talosintelligence.com
9. Ubuntu — CVE-2015-3246 ubuntu.com
10. Debian security tracker — CVE-2015-3246 security-tracker.debian.org