CVE-2015-5287: Red Hat ABRT privilege escalation via symlink attack

CVE-2015-5287 · Severity: critical · CVSS 7 · Exploited in the wild · Published 2026-08-26

Red Hat's Automatic Bug Reporting Tool (ABRT) is a system component that collects and reports application crash information to assist with debugging. A local privilege escalation vulnerability allows users with basic system access to gain elevated privileges by exploiting predictable file names and symlink attacks, potentially compromising system security and enabling unauthorized access to sensitive system functions.

Vendors: Red Hat.

Quick answers

Is CVE-2015-5287 exploited in the wild?
Yes. CVE-2015-5287 is known to be exploited in the wild, first recorded on 26 August 2026. Treat it as urgent.
How severe is CVE-2015-5287?
Critical severity, with a CVSS score of 7, published 26 August 2026.
Which products and versions are affected?
Red Hat Automatic Bug Reporting Tool (ABRT).
Is there a fix for CVE-2015-5287?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2015-5287 attacked?
It is attacked with local access.
Am I affected by CVE-2015-5287?
Check whether you run Red Hat Automatic Bug Reporting Tool. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2015-5287 is a privilege escalation vulnerability in Red Hat ABRT that exploits a symlink race condition on predictably named temporary files. The vulnerability allows a local attacker with user-level privileges to create symbolic links that redirect privileged file operations to arbitrary system locations. By leveraging this race condition, an attacker can achieve privilege escalation and execute arbitrary commands with elevated permissions. The attack requires local access to the system but does not require prior authentication to ABRT itself. This vulnerability has been exploited in the wild, indicating active attacks. While ABRT is noted as potentially end-of-life or end-of-service, users should apply patches or discontinue use of affected versions.

Affected products

  • Red Hat Automatic Bug Reporting Tool (ABRT)

Timeline

  • 2015: disclosed: CVE-2015-5287 disclosed
  • exploited: Known to be exploited in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.