# CVE-2015-5281

> As of 2024-08-06, CVE-2015-5281 is a vulnerability, EPSS 0.3% (25.1th percentile). Threadlinqs Intelligence links 2 tracked threat campaigns to CVE-2015-5281, most recently “Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797)”.

**Last updated:** 2024-08-06

## What is CVE-2015-5281?

The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.

The identifier was first published 3991 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 0.3% probability of exploitation in the next 30 days, higher than 25.1% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 3/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2015-11-24, last modified 2024-08-06

## Is CVE-2015-5281 being exploited?

Weaponised exploit code for CVE-2015-5281 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 24 in the Threadlinqs vulnerability feed.

- [trickest/cve](https://github.com/trickest/cve/blob/main/2015/CVE-2015-5281.md) (trickest)

## Affected products and versions

No affected-product or package list has been recorded for CVE-2015-5281 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.

## How to fix CVE-2015-5281

No vendor patch reference has been recorded for CVE-2015-5281 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2015-5281

2 tracked threats in the Threadlinqs corpus reference CVE-2015-5281, either in the campaign’s CVE list or as an indicator on the campaign record.

- [Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797)](https://intel.threadlinqs.com/threat/TL-2026-1298) — HIGH · 2026-07-14
- [11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797)](https://intel.threadlinqs.com/threat/TL-2026-1340) — HIGH · 2026-07-14

## Sources

Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

**Vendor advisory and patch**

- [lists.fedoraproject.org — vendor advisory](http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172942.html)
- [bugzilla.redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1264103)
- [oracle.com](http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html)
- [rhn.redhat.com — vendor advisory](http://rhn.redhat.com/errata/RHSA-2015-2401.html)
- [lists.fedoraproject.org — vendor advisory (172611)](http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172611.html)

**Vulnerability database entry**

- [securityfocus.com — vdb entry](http://www.securityfocus.com/bid/77983)
- [securitytracker.com — vdb entry](http://www.securitytracker.com/id/1034198)

Canonical: https://intel.threadlinqs.com/cve/CVE-2015-5281
Full detection coverage and IOCs for threats exploiting CVE-2015-5281 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp