CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2021-35217
High (8.8) in solarwinds patch manager. EPSS 73% chance of exploitation in the next 30 days.
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
Severity
- EPSS
- 73% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- solarwinds:patch_manager
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217
- https://www.zerodayinitiative.com/advisories/ZDI-21-1247/
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm