libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd,…

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

1. 2015-07-24 First public exploit (Metasploit exploit/linux/local/libuser_roothelper_priv_esc)
2. 2015-08-11 Published
3. 2026-08-26 Added to CISA KEV
4. 2026-08-27 CISA SSVC: exploitation active
5. 2026-09-09 CISA patch deadline

Added

2 mo ago (2026-08-26)

Patch by

2026-09-09 (2 mo ago)

Ransomware

Not known

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor, product

Red Hat, Libuser

CISA name

Red Hat Libuser Race Condition Vulnerability

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

2 mo ago (2026-08-27)

8.50% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

• Metasploit exploit/linux/local/libuser_roothelper_priv_esc Libuser roothelper Privilege Escalation metasploit exploit, great rank, 2015-07-24
• EDB-44633 Libuser - 'roothelper' Local Privilege Escalation (Metasploit) local, 2018-05-16
• EDB-37706 Libuser Library - Multiple Vulnerabilities dos, 2015-07-27
• qualys.com https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
• CWE-264 Permissions, Privileges, and Access Controls

• exploit-db.com /exploits/44633/

  exploit, third-party-advisory, vdb-entry

• qualys.com /2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt

  exploit

• lists.fedoraproject.org /pipermail/package-announce/2015-July/162947.html

  vendor-advisory, broken-link

• rhn.redhat.com /errata/RHSA-2015-1482.html

  vendor-advisory

• lists.fedoraproject.org /pipermail/package-announce/2015-August/163044.html

  vendor-advisory, broken-link

• lists.opensuse.org /opensuse-security-announce/2015-08/msg00000.html

  vendor-advisory, mailing-list, third-party-advisory

• rhn.redhat.com /errata/RHSA-2015-1483.html

  vendor-advisory

• access.redhat.com /articles/1537873

  mitigation, vendor-advisory

• securityfocus.com /bid/76022

  vdb-entry, third-party-advisory

• securitytracker.com /id/1033040

  vdb-entry, third-party-advisory

• blog.talosintelligence.com /uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/

  third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246

  government-resource, us-government-resource

• CVE List CVE-2015-3246
• NVD CVE-2015-3246

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.