Which products and versions are affected by CVE-2021-3560?

Affected: Polkit (Polkit Project) versions >= polkit 0.119; Openshift Container Platform (Redhat) versions 4.7; Virtualization (Redhat) versions 4.0, among others. The full list is in the CVE brief.

Is CVE-2021-3560 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 12, 2023.

Is CVE-2021-3560 in the CISA KEV catalog?

Yes. It was added on May 12, 2023 with a federal remediation due date of Jun 2, 2023.

Is there a public exploit for CVE-2021-3560?

Public exploit code is available.

Is there a fix for CVE-2021-3560?

Fixed versions are available, including cri-o 0:1.20.3-6.rhaos4.7.git0d0f863.el7, dhcp 12:4.3.6-41.el8_3.1, libpolkit0 0.113-5.21.1.

How urgently should CVE-2021-3560 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2021-3560

HighExploitedPublic exploit

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user.

Published Feb 16, 2022 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2021-3560, SUSE-SU-2021:1842-1, SUSE-SU-2021:1843-1, SUSE-SU-2021:1844-1, UBUNTU-CVE-2021-3560, USN-4980-1

Key Facts

Patch immediately

CVE-2021-3560 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Polkit (Polkit Project), Openshift Container Platform (Redhat), Virtualization (Redhat) and 16 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 12, 2023. Public exploit code is available.
EPSS estimates a 24% probability of exploitation in the next 30 days.
Fixed versions are available, including cri-o 0:1.20.3-6.rhaos4.7.git0d0f863.el7, dhcp 12:4.3.6-41.el8_3.1, libpolkit0 0.113-5.21.1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

24%

Higher than 97.8% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2021-3560 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	May 12, 2023	Jun 2, 2023	Not reported
Industry KEV feed	May 12, 2023	Jun 2, 2023	Not reported
CIRCL KEV	May 12, 2023	Jun 2, 2023	Not reported
ENISA EUVD	May 12, 2023	n/a	Not reported

Required action: Apply updates per vendor instructions.

Affected Products

206 affected entries in total

Product	Affected versions	Fixed in
PolkitPolkit Project	>= polkit 0.119	0.119
Openshift Container PlatformRedhat	4.7	n/a
VirtualizationRedhat	4.0	n/a
Virtualization HostRedhat	4.0	n/a
Ubuntu LinuxCanonical	20.04	n/a

14 more affected products in the full CVE brief

Patched Releases

cri-o

0:1.20.3-6.rhaos4.7.git0d0f863.el7

dhcp

12:4.3.6-41.el8_3.1

libpolkit0

0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1, 0.116-lp152.2.3.1, 0.118-7.2

libpolkit0-32bit

0.113-5.21.1, 0.116-3.3.1, 0.116-lp152.2.3.1, 0.118-7.2

openshift-clients

0:4.7.0-202106252127.p0.git.8b4b094.el7

openshift-kuryr

0:4.7.0-202106232224.p0.git.c7654fb.el8

policykit-1

0.105-26ubuntu1.1, 0.105-31

Polkit

0:0.115-9.el8_1.1, 0.113-5.21.1, 0.113-5.ph1, 0.113-6.ph2, 0.114-3.12.1, 0.115-11.0.1.el8_4.1, 0.115-11.el8_4.1, 0.116-2.ph3, 0.116-3.3.1, 0.116-6, 0.116-lp152.2.3.1, 0.118-2.ph4, 0.118-7.2, 0.119-1, 0.119-r0, 0.119

polkit-devel

0.113-5.21.1, 0.114-3.12.1, 0.115-11.0.1.el8_4.1, 0.116-3.3.1, 0.116-lp152.2.3.1, 0.118-2.ph4, 0.118-7.2

polkit-doc

0.116-3.3.1, 0.116-lp152.2.3.1, 0.118-7.2

polkit-docs

0.115-11.0.1.el8_4.1

polkit-libs

0.115-11.0.1.el8_4.1

redhat-virtualization-host

0:4.4.6-20210615.0.el8_4

typelib-1_0-Polkit-1_0

0.113-5.21.1, 0.114-3.12.1, 0.116-3.3.1, 0.116-lp152.2.3.1, 0.118-7.2

Timeline

Publicly disclosed
Feb 16, 2022
Added to CISA KEV
May 12, 2023
Added to Industry KEV feed
May 12, 2023
Added to CIRCL KEV
May 12, 2023
Added to ENISA EUVD
May 12, 2023
Last updated
Aug 4, 2026

Weakness Type

CWE-754 Improper Check for Unusual or Exceptional Conditions
CWE-863 Incorrect Authorization

References

advisoryhttp://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html
advisoryhttp://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html
advisoryRHSA-2021:2236
advisoryRHSA-2021:2237
advisoryRHSA-2021:2238

15 more references in the full CVE brief

FAQ

Common Questions.

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user.
Affected: Polkit (Polkit Project) versions >= polkit 0.119; Openshift Container Platform (Redhat) versions 4.7; Virtualization (Redhat) versions 4.0, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 12, 2023.
Yes. It was added on May 12, 2023 with a federal remediation due date of Jun 2, 2023.
Public exploit code is available.
Fixed versions are available, including cri-o 0:1.20.3-6.rhaos4.7.git0d0f863.el7, dhcp 12:4.3.6-41.el8_3.1, libpolkit0 0.113-5.21.1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2021-3560 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.