Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-28041

25
FAUCET Score

CVE-2021-28041 is a double free vulnerability in the ssh-agent component of OpenSSH versions prior to 8.5, impacting products like Fedora, NetApp, OpenBSD, and Oracle. With a CVSS score of 7.1 (High), exploitation requires high attack complexity and user interaction, but could lead to high impact on confidentiality, integrity, and availability in specific scenarios like unconstrained agent-socket access or agent forwarding to a malicious host. Currently, there is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 8.2, < 8.5CPE matchmatch criteria
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
33CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
34CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.1HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.2
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.42%
Probability of exploitation in next 30 days
EPSS Percentile
87.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0342 is in the 95th percentile among its peer group of 102 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (17)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 14271-12137Fixed in: -
microsoftpatch availablevia msrc
Product: 14272-12137Fixed in: -
microsoftpatch availablevia msrc
Product: 14273-12137Fixed in: -
microsoftpatch availablevia msrc
Product: 14274-12137Fixed in: -
microsoftpatch availablevia msrc
Product: 14275-12138Fixed in: -
microsoftpatch availablevia msrc
Product: 14276-12138Fixed in: -
microsoftpatch availablevia msrc
Product: 14277-12138Fixed in: -
microsoftpatch availablevia msrc
Product: 14278-12138Fixed in: -
microsoftpatch availablevia msrc
Product: openssh-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: -
microsoftpatch availablevia msrc
Product: openssh-clients-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: -
microsoftpatch availablevia msrc
Product: openssh-server-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: -
microsoftpatch availablevia msrc
Product: openssh-debuginfo-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: -
microsoftpatch availablevia msrc
Product: openssh-8.5p1-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: -
microsoftpatch availablevia msrc
Product: openssh-clients-8.5p1-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: -
microsoftpatch availablevia msrc
Product: openssh-server-8.5p1-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: -
microsoftpatch availablevia msrc
Product: openssh-debuginfo-8.5p1-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: -

Vendor Advisories (2)

microsoft2021-Mar/CVE-2021-28041

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios such as unconstrained agent-socket access on a legacy operating system or the forwarding of an agent to an attacker-controlled host.

Mar 9, 2021
redhatCVE-2021-28041Moderate

openssh: double-free memory corruption may lead to arbitrary code execution

Mar 3, 2021

References

github.com / openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d9946397ff60d96568db
PatchThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/KQWGII3LQR4AOTPPFXGMTYE7UDEWIUKI
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/TXST2CML2MWY3PNVUXX7FFJE3ATJMNVZ
security.gentoo.org / glsa/202105-35
Third Party Advisory
security.netapp.com / advisory/ntap-20210416-0002
Third Party Advisory
openssh.com / security.html
Not ApplicableVendor Advisory
openssh.com / txt/release-8.5
Release NotesVendor Advisory
openwall.com / lists/oss-security/2021/03/03/1
Mailing ListPatchThird Party Advisory
oracle.com / /security-alerts/cpujul2021.html
Third Party Advisory