VULNERABILITY INTELLIGENCE
CVE-2021-35217
CVSS score8.9 HIGH
EPSS probability72.79%
CISA KEVNot currently listed
Published2021-09-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Description
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
Weakness classification
- CWE-502: Deserialization of Untrusted Data
Primary references
- psirt@solarwinds.com — Vendor Advisory
- psirt@solarwinds.com — Release Notes, Vendor Advisory
- psirt@solarwinds.com — Vendor Advisory
- psirt@solarwinds.com — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry