CVEvulnerability
CVE-2021-35216
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-09-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.9 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-502
Description
Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.
Affected configurations
• solarwinds patch manager (< 2020.2.6)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm Release Notes, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35216 Patch, Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-1246/ Third Party Advisory, VDB Entry
- https://documentation.solarwinds.com/en/success_center/patchman/content/release_notes/patchman_2020-2-6_release_notes.htm Release Notes, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35216 Patch, Vendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-1246/ Third Party Advisory, VDB Entry