CVE-2021-3560: polkit D-Bus credential check bypass allows local root escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityLocal privilege escalation to root with a public exploit and KEV listing, but it requires an existing local foothold rather than remote reach.

What it is

polkit can be tricked into bypassing credential checks for D-Bus requests, letting an unprivileged local user elevate to root. Because polkit is a core authorization component on many Linux distributions, a local foothold can be turned into full administrative control of the host.

Impact

An attacker gains root privileges, enabling creation of a new local administrator account and full read/write access to data plus the ability to disrupt system availability.

Attack surface

Reached locally through D-Bus requests to polkit; the CVSS vector shows local access (AV:L) with low privileges (PR:L) and no user interaction (UI:N). No remote or network vector is described.

Exploitation

Listed in CISA KEV since 2023-05-12 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.23708 (97.7th percentile). A public exploit write-up is referenced, so exploitation is established and active.

What to do

• Apply vendor polkit updates for your distribution (Red Hat, Debian, Ubuntu, Canonical) per the vendor advisory and KEV required action.
• Restrict local interactive access and audit accounts with shell or D-Bus access on multi-user hosts.
• Monitor for unexpected creation of local administrator or sudo-capable accounts.
• Where patching is delayed, limit exposure by reducing untrusted local users on affected systems.

Detection

• Alert on new or modified accounts in /etc/passwd, /etc/shadow and sudoers files outside change windows.
• Monitor process ancestry where polkit or dbus-daemon spawns shells or administrative tools unexpectedly.
• Audit D-Bus method calls to polkit from non-privileged UIDs for anomalous patterns.
• Track host-level privilege escalation events correlated with recent local logins.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.