CVE-2021-35217

HIGH 8.8CVE-2021-35217 · Published 08/09/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
patch manager solarwinds	`≤ 2020.2.5`	No fix yet

Description

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.

References

documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm · Vendor Advisory
documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htm · Release Notes
solarwinds.com/trust-center/security-advisories/cve-2021-35217 · Vendor Advisory
zerodayinitiative.com/advisories/ZDI-21-1247 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free