Security news, read and ranked every 30 minutes.
Exploited. On CISA's list since 2022-06-27, and used by ransomware.
CVE-2021-4034 · Red Hat Polkit · Published 2022-01-28
7.8 out of 10
CVSS rates it high.
95%
Estimated chance of exploitation in the next 30 days, among the top 1% of all scored flaws (EPSS, 2026-10-29).
Yes
CISA has seen it exploited in real attacks. For US government agencies the fix is deadline passed 1565 days ago (2022-07-18).
Apply updates per vendor instructions.
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
From the NVD.
Explore this week’s weaknesses and all learning topics
Understand the kind of weakness behind this flaw. These resources teach the weakness, rather than reproduce this specific CVE. Follow the vendor's advice above to fix the affected product.
A program writes outside the memory region it is allowed to use.
CWE-787 · CISA KEV; NVD record: nvd@nist.gov; NVD record: secalert@redhat.com
Video course · Free course. C programming and memory concepts are useful; covers several weakness types.
CWE-125 · NVD record: nvd@nist.gov. We have not selected a close learning match for this label.
CWE is a catalogue of weakness types. Labels come from the sources shown and can differ or change. Resource matches reviewed 16 October 2026.
No story in the last 14 days has mentioned it.
Exploited flaws from CISA's KEV catalogue. Chance of exploitation from EPSS by FIRST. Descriptions and scores from the NVD. This product uses the NVD API but is not endorsed or certified by the NVD.