CVE-2021-4034Vulnerability
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Reported by 5 independent sources · first reported by Elastic Security Labs · last reported
Last reported 9 days ago
Fix due 18 Jul 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
AI-Powered Espionage Campaign Targets Government Linux Infrastructure“CVE-2021-4034 (PwnKit binary)”
-
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records“Deploying tools like GodPotato, Kerberoast, AS-REProast, Evil-WinRM, and exploits like CVE-2021-4034 (aka PwnKit), CVE-2024-1086, and CVE-2020-1938 (aka Ghostcat) for privilege escalation, followed by lateral movement to adjacent systems.”
-
Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization Pipeline“Local Privilege Escalation: PwnKit (CVE-2021-4034), an nf_tables kernel exploit (CVE-2024-1086), and a Tomcat Ghostcat AJP client (CVE-2020-1938)”
-
July 2026 CVE Landscape“CVE-2021-4034”
-
Betting on Bots: Investigating Linux malware, crypto mining, and gambling API abuse“Further attempts at privilege escalation involved exploiting CVE-2021-4034, also known as pwnkit.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-0257, CVE-2025-55182, CVE-2026-60137, CVE-2026-63030, CVE-2022-28368, CVE-2023-7028, CVE-2024-1086, CVE-2020-1938, CVE-2025-49113, CVE-2026-33824, CVE-2024-42009, CVE-2026-15409, CVE-2026-15410, CVE-2026-25089, CVE-2026-39808, CVE-2026-42897, CVE-2018-0802, CVE-2026-50522, CVE-2026-58644, CVE-2025-3248
Thanks — we review every report.