How severe is CVE-2021-3560?

CVE-2021-3560 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-3560 being actively exploited?

Yes. CVE-2021-3560 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-05-12, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2021-3560?

CVE-2021-3560 primarily affects Redhat Virtualization. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-3560?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2021-3560 have an EU (EUVD) identifier?

Yes. CVE-2021-3560 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2021-26871. It is also flagged as exploited in the EUVD (since 2023-05-12).

When was CVE-2021-3560 published?

CVE-2021-3560 was published on 2022-02-16 and last updated on 2026-06-17.

CVE-2021-3560

CVE-2021-3560 is a high-severity vulnerability in Redhat Virtualization with a CVSS 3.x base score of 7.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2023-05-12). The underlying weakness is classified as CWE-754.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v2: 7.2
EPSS exploit prediction: 22% (97th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2023-05-12)
EU (EUVD) id: EUVD-2021-26871
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2023-05-12)
Weakness: CWE-754
Affected product: Redhat Virtualization
Published: 2022-02-16
Last modified: 2026-06-17

Description

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Frequently asked questions

What is CVE-2021-3560?: It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
How severe is CVE-2021-3560?: CVE-2021-3560 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-3560 being actively exploited?: Yes. CVE-2021-3560 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-05-12, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2021-3560?: CVE-2021-3560 primarily affects Redhat Virtualization. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-3560?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2021-3560 have an EU (EUVD) identifier?: Yes. CVE-2021-3560 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2021-26871. It is also flagged as exploited in the EUVD (since 2023-05-12).
When was CVE-2021-3560 published?: CVE-2021-3560 was published on 2022-02-16 and last updated on 2026-06-17.

References

Affected products (6)

cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.7:*:*:*:*:*:*:*

More vulnerabilities in Redhat Virtualization

CVE-2015-0235 — Critical (CVSS 10.0): Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,…
CVE-2019-10126 — Critical (CVSS 9.8): A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in…
CVE-2019-3888 — Critical (CVSS 9.8): A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials…
CVE-2019-10160 — Critical (CVSS 9.8): A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3…
CVE-2019-9636 — Critical (CVSS 9.8): Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an…
CVE-2018-17963 — Critical (CVSS 9.8): qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause…

All CVEs affecting Redhat Virtualization →

Other CWE-754 (Improper Check for Unusual or Exceptional Conditions) vulnerabilities

CVE-2026-24054 — Critical (CVSS 10.0): Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs)…
CVE-2021-0211 — Critical (CVSS 10.0): An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing…
CVE-2026-8091 — Critical (CVSS 9.8): Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150,…
CVE-2024-52316 — Critical (CVSS 9.8): Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta…
CVE-2024-7826 — Critical (CVSS 9.8): Improper Check for Unusual or Exceptional Conditions vulnerability in Webroot SecureAnywhere - Web Shield on Windows,…
CVE-2023-37303 — Critical (CVSS 9.8): An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to…

Browse all CWE-754 (Improper Check for Unusual or Exceptional Conditions) vulnerabilities →