CVE-2020-12145

9.8 criticalEPSS 6.0%

Critical (9.8) in silver-peak unity orchestrator. EPSS 6.0% chance of exploitation in the next 30 days.

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 6.0% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2020-11-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

silver-peak:unity_orchestrator

References

https://www.silver-peak.com/support/user-documentation/security-advisories
https://www.silver-peak.com/support/user-documentation/security-advisories

Check your stack JSON