CVE-2015-3246
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Aug 26, 2026
- US federal agencies must remediate it by Sep 9, 2026 (BOD 22-01)
- First attack observed 4026 days after disclosure
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 8, 2026 Aug 26, 2026 Aug 26, 2026 Aug 20, 2026
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| redhat | libuser | <= 0.56.13-5 |
| redhat | enterprise linux | 5.0 |
| opensuse | opensuse | 13.2 |
| libuser project | libuser | < 0.56.13-8 |
Related articles
PoeLLM Uses Exposed AI Services to Build a 2,100-Server Mining Network
Black Lotus Labs says PoeLLM malware compromised over 2,100 exposed servers for mining, remote shell access and scanning.
Sangoma Switchvox Under Attack: Critical SQL Injection Enables Remote Code Execution
CVE-2026-9586 in Sangoma Switchvox exploited via unauthenticated SQL injection at /pa enabling RCE. Update to 8.4.0.2 and hunt for compromise.
An ownCloud flaw allowed theft of Philippine nuclear data: CISA adds it to KEV
On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an
ZBT: Two New Factory Implants in Chinese Routers Expose Remote Root Access
On August 28, 2026, The Hacker News confirmed through the IEEE registered MAC prefix database that the blocks 78:A3:51 and F8:5E:3C belong to Shenzhen
SPECTRE, the backdoor that disables EDRs: inside UAT-10147's arsenal
Recently, Cisco Talos published a two-part analysis of the Chinese-speaking group UAT-10147 , which is active against Windows and Linux web servers on a
This product uses the NVD API but is not endorsed or certified by the NVD.