Is CVE-2021-41554 actively exploited?

No active exploitation of CVE-2021-41554 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-41554 be exploited remotely?

Yes. CVE-2021-41554 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-41554?

CVE-2021-41554 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2021-41554

HIGH

CVE-2021-41554

CWE-862Published: October 5, 2021· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw. By not verifying the permissions for access to resources, it allows a potential attacker to view pages that are not allowed. Specifically, it was found that any authenticated user can reach the administrative console for user management by directly requesting access to the page via URL. This allows a malicious user to modify all users' profiles, to elevate any privileges to administrative ones, or to create or delete any type of user. It is also possible to modify the emails of other users, through a misconfiguration of the username parameter, on the user profile page. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020

NVD Source

Technical Analysis

CVE-2021-41554 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.