A 2015 CVE added to KEV in 2026 - an old weakness recorded as exploited now (Red Hat libuser, CVE-2015-3246)
A race condition vulnerability in Red Hat libuser has been added to CISA's Known Exploited Vulnerabilities catalog. Authenticated local users can corrupt /etc/passwd to cause denial of service or privilege escalation. The CVE number dates from 2015.
Key facts
- CVE IDCVE-2015-3246
- Affected (vendor / product)Red Hat Libuser
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-09-09 (U.S. federal civilian agencies, BOD 22-01)
Key points
- A race condition in Red Hat libuser lets authenticated local users corrupt /etc/passwd, causing denial of service or privilege escalation.
- The CVE number dates from 2015 while KEV addition came on 26 August 2026, meaning exploitation is confirmed now.
- Of the 1,687 KEV records this site holds as of 2026-09-02, 724 (43 per cent) have the CVE year equal to the year added.
- Ninety-one records carry a gap of ten years or more, the longest being 20 years.
- A race condition exploits the small interval between checking a state and acting on it.
- Low-level libraries may not appear in an asset inventory, and KEV listing becomes the occasion to take stock.
1A number eleven years old, listed now
KEV is a list of vulnerabilities confirmed as exploited. What this record means, then, is that a weakness found in 2015 is being exploited now. The age of a number does not put the danger in the past.
While 43 per cent are added in the year of the CVE, 91 records carry a gap of ten years or more. How long ago something was published and whether it is being targeted now are separate questions.
2What a race condition is
- 1CheckThe program confirms the state of a target file
- 2A gap opensTime passes between the check and the actual operation
- 3It is swappedAnother process replaces the target in that interval
- 4It breaks/etc/passwd is corrupted, causing denial of service or privilege escalation
A race condition exploits the small interval between checking and acting. Exploitation requires being authenticated on the target environment, which is enough to serve as a foothold for an attacker already inside to raise privilege.
3Why old weaknesses persist
The longer a system runs, the more components it carries whose updates have stopped. Low-level libraries like libuser often keep running without being consciously noticed and may not appear in an asset inventory at all. Appearing in KEV becomes the occasion to take stock of those unseen old parts. Nine records this site holds as of 2026-09-02 concern Red Hat.
Why it matters
Vulnerability management weighted toward newly published items responds late when an old number appears in KEV. The longer a system has run, the more low-level components it carries whose updates have stopped, and those may not appear in an inventory. Because KEV is ordered by the fact of exploitation rather than year of publication, cutting off by year is dangerous.
FAQ
Why is a 2015 CVE listed now?
What is a race condition?
Can it be exploited remotely?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).