VULNERABILITY INTELLIGENCE

CVE-2021-35218

CVSS score8.9 HIGH

EPSS probability76.41%

CISA KEVNot currently listed

Published2021-09-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Description

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server

Weakness classification

psirt@solarwinds.com: CWE-502
nvd@nist.gov: CWE-502

Primary references

psirt@solarwinds.com — Not Applicable, Vendor Advisory
psirt@solarwinds.com — Vendor Advisory
psirt@solarwinds.com — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Not Applicable, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry