{"vulnerability": "CVE-2015-3246", "sightings": [{"uuid": "8c82848b-a622-41a9-9299-52d49be22c38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "exploited", "source": "https://www.exploit-db.com/exploits/44633", "content": "", "creation_timestamp": "2018-05-16T00:00:00.000000Z"}, {"uuid": "af33235f-3eca-42be-a0de-c16b0f05f358", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "0cfebf31-1b99-4ebd-83d2-be6a79cf1d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:39.000000Z"}, {"uuid": "b36616c9-3433-423e-9544-43025949a062", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/libuser_roothelper_priv_esc.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "0b2f9d4c-e4eb-42bb-b7ee-20de6b76ee5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:09.000000Z"}, {"uuid": "dd28acbf-6489-41c8-a8ae-1cd05db97723", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2015-3246", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/37706", "content": "", "creation_timestamp": "2015-07-27T00:00:00.000000Z"}, {"uuid": "a189926a-aba5-49d6-8a20-9f7ca41d3b2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-29T23:00:19.029285Z"}, {"uuid": "3b766ece-a899-4f22-bcea-bd386f043927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-30T00:00:27.352940Z"}, {"uuid": "25d643f8-7ddc-41bc-9720-4a4f2293c966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mueh6cftmy2q", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-08-31T08:06:46.415780Z"}, {"uuid": "447dec7f-e009-4ef0-a08e-cf9128e5a5bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "published-proof-of-concept", "source": "Telegram/BMLRzi6GxNLh9Y-kste7qnOEyxUjpKwyZDAyz25BJw9R9vo", "content": "", "creation_timestamp": "2026-08-27T14:00:12.124265Z"}, {"uuid": "182490e1-1914-49fa-aef3-d06f47e0a920", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mtyuwtzxn627", "content": "\ud83d\uded1 CVE-2015-3246\nRed Hat Libuser\nEPSS 7% / KEV: No\nTL;DR: libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode packa\u2026\nhttps://cvesentinel.com/report/CVE-2015-3246?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-08-26T17:41:12.008502Z"}, {"uuid": "dad41bc9-73ca-408e-9d33-f79026a59d05", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/53718327-1fd6-4cac-98e7-b8b7062a9313", "content": "", "creation_timestamp": "2026-08-26T18:00:02.392972Z"}, {"uuid": "fb5b4750-44f6-43f6-a464-455fe02772cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "published-proof-of-concept", "source": "Telegram/BMLRzi6GxNLh9Y-kste7qnOEyxUjpKwyZDAyz25BJw9R9vo", "content": "", "creation_timestamp": "2026-08-28T00:00:43.290350Z"}, {"uuid": "a70416c5-0b0b-47ad-97a7-f2d7360dc966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mtzefi2rys2j", "content": "\ud83d\udea8 CISA Adds 6 KEV to Catalog\n\n\ud83d\udd34 CVE-2015-3246 Red Hat Libuser\n\ud83d\udfe0 CVE-2015-5287 Red Hat Automatic Bug Reporting Tool\n\ud83d\udd34 CVE-2019-1068 MS SQL Server\n\ud83d\udd34 CVE-2021-23758 Ajax.NET Professional\n\ud83d\udd34 CVE-2022-0995 Linux Kernel\n\ud83d\udd34 CVE-2026-8452 Citrix NetScaler ADC & NetScaler GW\n\nsecdb.nttzen.cloud/security-adv...", "creation_timestamp": "2026-08-26T22:17:50.167063Z"}, {"uuid": "5602f4ff-a761-4512-8192-7892db13c4ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2015-3246", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mu457eeuxg2q", "content": "Red Hat Libuser Race Condition Vulnerability https://0daynews.com/cves/cve-2015-3246", "creation_timestamp": "2026-08-28T00:47:07.014067Z"}, {"uuid": "b3bdc97c-3055-487d-a758-cd241dd5abf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mtziquukfu2j", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2015-3246: Red Hat Libuser Race Condition Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2015-3246", "creation_timestamp": "2026-08-26T23:35:46.865881Z"}, {"uuid": "e702f7d8-2f6f-463f-84c8-30248f2669db", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9b0d3a54-8baf-4ef3-93cb-fa7c04bd4425", "content": "", "creation_timestamp": "2026-08-27T18:00:33.633192Z"}, {"uuid": "0a43b2fe-1139-4052-a891-ab0c09954d1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mu23of2xaf2c", "content": "CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2015-3246 Red Hat Libuser Race Condition Vu...\n\n\ud83d\udd17 https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-08-27T05:14:23.943792Z"}, {"uuid": "be211ba5-3878-48dc-9e10-5da67a86c0c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mu27wtxjcx2b", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2015-3246: \u26a0\ufe0f CVE-2015-3246: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 7.1%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2015-3246-libuser-before-05613-8-and-060-before", "creation_timestamp": "2026-08-27T06:30:43.151006Z"}, {"uuid": "70b95427-a737-462d-815b-f11cf7eef879", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mu2i2qd6p22l", "content": "\ud83d\udea8 Executive Risk Brief: CVE-2015-3246 targets Red Hat libuser via authentication race conditions. Leaders must review asset visibility, compliance tracking, and endpoint hardening protocols. Read the full CSUITE brief from The Cyber Mind Co. https://thecybermind.co/7ei4", "creation_timestamp": "2026-08-27T08:56:04.374000Z"}, {"uuid": "8a7a3777-a8a2-41c2-9f6e-23f1584341ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "published-proof-of-concept", "source": "Telegram/Wo1B2qy3supRi9RLVnMbQ41knoxctT-bVTE1SmDL-J33mLU", "content": "", "creation_timestamp": "2026-08-31T00:00:40.518177Z"}, {"uuid": "529167d2-be7b-4059-a065-1e584540c4e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3muw2kwoiqt25", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-09-07T08:09:07.174501Z"}, {"uuid": "6308ade6-b696-4c85-a867-4276dcafa0b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/libuser_roothelper_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Qualys\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module attempts to gain root privileges on Red Hat based Linux\\n          systems, including RHEL, Fedora and CentOS, by exploiting a newline\\n          injection vulnerability in libuser and userhelper versions prior to\\n          0.56.13-8 and version 0.60 before 0.60-7.\\n\\n          This module makes use of the roothelper.c exploit from Qualys to\\n          insert a new user with UID=0 in /etc/passwd.\\n\\n          Note, the password for the current user is required by userhelper.\\n\\n          Note, on some systems, such as Fedora 11, the user entry for the\\n          current user in /etc/passwd will become corrupted and exploitation\\n          will fail.\\n\\n          This module has been tested successfully on libuser packaged versions\\n          0.56.13-4.el6 on CentOS 6.0 (x86_64);\\n          0.56.13-5.el6 on CentOS 6.5 (x86_64);\\n          0.60-5.el7 on CentOS 7.1-1503 (x86_64);\\n          0.56.16-1.fc13 on Fedora 13 (i686);\\n          0.59-1.fc19 on Fedora Desktop 19 (x86_64);\\n          0.60-3.fc20 on Fedora Desktop 20 (x86_64);\\n          0.60-6.fc21 on Fedora Desktop 21 (x86_64);\\n          0.60-6.fc22 on Fedora Desktop 22 (x86_64);\\n          0.56.13-5.el6 on Red Hat 6.6 (x86_64); and\\n          0.60-5.el7 on Red Hat 7.0 (x86_64).\\n\\n          RHEL 5 is vulnerable, however the installed version of glibc (2.5)\\n          is missing various functions required by roothelper.c.\", \"disclosure_date\": \"2015-07-24\", \"fullname\": \"exploit/linux/local/libuser_roothelper_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"Libuser roothelper Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"roothelper.c\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/exploits/linux/local/libuser_roothelper_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": true, \"rank\": 500, \"ref_name\": \"linux/local/libuser_roothelper_priv_esc\", \"references\": [\"EDB-37706\", \"CVE-2015-3245\", \"CVE-2015-3246\", \"BID-76021\", \"BID-76022\", \"URL-https://seclists.org/oss-sec/2015/q3/185\", \"URL-https://access.redhat.com/articles/1537873\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:09.517683Z"}, {"uuid": "3631f086-6072-4033-a889-2947e66c953e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mvhnrkgzst26", "content": "Oldest CVEs in this batch: CVE-2015-3246 (Red Hat), CVE-2015-5287 (Red Hat), CVE-2019-1068 (Microsoft), CVE-2021-23758 (Ajax.NET Professional).", "creation_timestamp": "2026-09-14T08:08:05.968946Z"}, {"uuid": "5bea4dd0-6868-4205-8ec9-eebc86378ace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-3246", "type": "seen", "source": "https://t.me/VulnerabilityNews/44179", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2015-3246 Red Hat Libuser Race Condition Vulnerability\nCVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability\nCVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability\nCVE-2021-23758 Ajax.NET Professional Deserialization of Untrusted Data Vulnerability\nCVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability\nCVE-2026-8452 Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-18T12:00:06.626926Z"}]}