Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U H H H 7.8 .2371 97.8 YES
AFFECTED Product Versions Fixed polkit polkit 0.119 – —
TIMELINE May 20 Reserved by redhat Feb 16 Published (CNA: redhat) May 12 Added to CISA KEV, remediation due 2023-06-02
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
| Date | Event | Detail |
|---|---|---|
| May 20, 2021 | Reserved | Reserved by redhat |
| February 16, 2022 | Published | Published (CNA: redhat) |
| May 12, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-06-02 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | polkit | — | polkit 0.119 | — |
Authoritative record: CVE-2021-3560 at cve.org
Weaknesses: CWE-863
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-3560 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
