How severe is CVE-2015-7544?

CVE-2015-7544 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2015-7544 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (88th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-7544?

CVE-2015-7544 primarily affects Redhat Enterprise Virtualization Manager. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-7544?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2015-7544 published?

CVE-2015-7544 was published on 2017-09-25 and last updated on 2026-06-17.

CVE-2015-7544

CVE-2015-7544 is a critical-severity vulnerability in Redhat Enterprise Virtualization Manager with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
CVSS v2: 9.0
EPSS exploit prediction: 3% (88th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-74
Affected product: Redhat Enterprise Virtualization Manager
Published: 2017-09-25
Last modified: 2026-06-17

Description

redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.

Frequently asked questions

What is CVE-2015-7544?: redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.
How severe is CVE-2015-7544?: CVE-2015-7544 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2015-7544 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (88th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-7544?: CVE-2015-7544 primarily affects Redhat Enterprise Virtualization Manager. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-7544?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2015-7544 published?: CVE-2015-7544 was published on 2017-09-25 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:redhat:enterprise_virtualization_manager:3.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:enterprise_virtualization_manager:3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:enterprise_virtualization_manager:3.5.0:*:*:*:*:*:*:*

More vulnerabilities in Redhat Enterprise Virtualization Manager

CVE-2018-8897 — High (CVSS 7.8): A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM)…
CVE-2015-0237 — Medium (CVSS 6.8): Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during…
CVE-2012-0861 — Medium (CVSS 6.8): The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k…
CVE-2010-2793 — Medium (CVSS 6.8): Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization…
CVE-2014-3573 — Medium (CVSS 6.5): The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure…
CVE-2012-0860 — Medium (CVSS 6.2): Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when…

All CVEs affecting Redhat Enterprise Virtualization Manager →

Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities

CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…

Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →