1. Executive summary
CVE-2015-346 is a race condition vulnerability (CWE-264, CWE-367) in Red Hat libuser that allows authenticated local users to corrupt the /etc/passwd file, resulting in denial of service or privilege escalation. The vulnerability carries a CVSS 5.1 MEDIUM severity rating and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-26 with an EPSS of 7%. EMEA financial services running affected Red Hat Enterprise Linux environments with local untrusted user populations (e.g., multi-tenant shell hosts, CI/CD runners, or interactive developer workstations) should treat this as a local privilege-escalation and system-integrity risk and remediate within the KEV deadline.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | The vulnerability is in CISA KEV, establishing a known exploitation risk that must be addressed under resilience testing programmes. | Clients must verify that affected libuser versions are identified in asset inventories and that remediation is tracked under DORA testing obligations. |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | KEV inclusion establishes a credible exploitation vector; if exploitation is detected on an in-scope system, it may constitute a reportable major ICT-related incident. | Clients must be prepared to classify and report any confirmed exploitation under their DORA incident reporting framework. |
3. Technical analysis & attack chain
Vulnerability mechanism: Red Hat libuser contains a time-of-check / time-of-use (TOCTOU) race condition (CWE-367) in its handling of user account database files. The flaw allows an authenticated local user to manipulate the /etc/passwd file during the window between libuser's check and use operations, resulting in file corruption. The corruption can be leveraged for two outcomes: denial of service (system unable to authenticate users) or privilege escalation (attacker gains elevated privileges through corrupted account entries).
Attack chain (confirmed steps)
- Prerequisite — local authenticated access: The attacker must already have a valid local user account on the target system. This is not a remote exploitation vector.
- Trigger libuser operation: The attacker initiates or waits for a libuser-mediated account operation (e.g., password change, user modification) that reads and writes
/etc/passwd. - Exploit TOCTOU window: During the interval between libuser's read (check) and write (use) of
/etc/passwd, the attacker manipulates the file state to introduce corruption — either replacing or altering entries to inject elevated privileges or render the file invalid. - Outcome — DoS or privilege escalation: The corrupted
/etc/passwdeither prevents legitimate authentication (denial of service) or grants the attacker unintended elevated access (privilege escalation).
Affected component: Red Hat libuser library (libuser package on RHEL and derivative distributions).
Key constraints
- Requires authenticated local access — not exploitable remotely.
- The attacker must be able to time operations within the TOCTOU window, which may require repeated attempts.
- No CISA-KEV remediation due-date is specified in the verified reference data; however, the primary item source references a due date of 2026-09-09 associated with BOD 26-04 compliance. This due date appears in the CISA KEV entry context but is not confirmed in the NVD verified data — treat as single-sourced from the KEV entry.
No named threat actor is associated with this vulnerability. No ransomware campaign use has been confirmed (source states "Unknown").
4. Mitigation & containment
P1 — Within 24 hours
- Identify all RHEL and derivative systems (CentOS, Rocky, AlmaLinux, Fedora) running the
libuserpackage. Enumerate with:rpm -qa | grep libuserordnf list installed | grep libuser. - Identify systems with local untrusted user populations (multi-tenant hosts, shared development servers, CI/CD runners, jump hosts with shell access) and prioritise these for immediate remediation — they represent the highest exploitation risk.
- If immediate patching is not feasible, restrict local shell access on affected hosts to essential administrative personnel only. Remove or suspend non-essential local user accounts.
P2 — Within 72 hours
- Apply the vendor-provided update for libuser on all affected systems. Use:
dnf update libuser(RHEL 8/9 and derivatives) oryum update libuser(RHEL 7 and earlier). - Verify the update:
rpm -qi libuser— confirm the installed version is at or above the vendor-fixed release. - For systems that cannot be updated immediately, consider applying SELinux policies that restrict write access to
/etc/passwdfor non-root processes, or deploy audit rules to monitor for suspicious/etc/passwdaccess:auditctl -w /etc/passwd -p wa -k passwd_modification.
P3 — Within 7 days
- Validate that all patched systems have been rebooted or that affected services have been restarted to ensure the updated libuser library is loaded into memory.
- Review historical audit logs for evidence of
/etc/passwdcorruption or unexpected privilege changes on systems that were running vulnerable versions. Look for: unexpected UID 0 entries, duplicate usernames, or malformed passwd file entries. - Update baseline configuration management (Ansible, Puppet, Salt) to enforce the minimum libuser version across the estate.
5. Indicators of compromise
No indicators of compromise available in the source material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
Unexpected modification of /etc/passwd outside of legitimate account management workflows |
Audit logs (auditctl), file integrity monitoring (AIDE, Tripwire) |
Medium — consistent with vulnerability mechanism |
Corrupted or malformed entries in /etc/passwd (unexpected UID 0 accounts, duplicate usernames, truncated lines) |
/etc/passwd file inspection, FIM alerts |
Medium — direct outcome of exploitation |
| Sudden authentication failures across multiple user accounts (DoS outcome) | /var/log/secure, /var/log/auth.log, SSSD logs |
Low — non-specific but consistent with DoS outcome |
| Privilege escalation from a previously low-privilege local user to root without sudo/su authorisation | Audit logs, process accounting, EDR telemetry | Medium — consistent with privesc outcome |
6. Detection
Insufficient indicators to author detection rules. The vulnerability is a local TOCTOU race condition in a system library; no distinctive strings, command-line flags, mutex names, file artefacts, or network indicators are present in the source material. Detection should rely on the behavioural indicators in §5 — specifically file integrity monitoring on /etc/passwd and auditd rules for passwd file access by non-root users.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2015-3246 | 5.1 Medium | ⚠ KEV 2026-08-26 | 7% | libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /… |
7. Sources
- NVD, CVE-2015-3246 Detail, https://nvd.nist.gov/vuln/detail/CVE-2015-3246, published 2026-08-25
- CISA KEV entry (via primary item), CVE-2015-3246, added 2026-08-26
8. Adverse Trace position
CVE-2015-3246 is a CVSS 5.1 MEDIUM local privilege escalation / denial of service vulnerability in Red Hat libuser, now in CISA KEV with an EPSS of 7%. The risk to EMEA financial services is bounded but real: exploitation requires authenticated local access, limiting the threat surface to systems with untrusted local users. Clients should prioritise multi-tenant Linux hosts, CI/CD infrastructure, and interactive developer environments. The KEV addition on 2026-08-26 indicates active or anticipated exploitation — patch within the referenced 2026-09-09 deadline. No threat actor attribution or ransomware involvement has been confirmed. We will monitor for emergence of public exploit code or IOCs and update this advisory if exploitation patterns are observed in the wild.
Published via PulseTrace — Adverse Trace threat intelligence.