CVE-2021-35217

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
SolarWinds	Orion Platform	>= 2020.2.5 and previous versions, < 2020.2.6

References

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmVendor Advisory
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1247/Third Party Advisory, VDB Entry
https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmVendor Advisory
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1247/Third Party Advisory, VDB Entry

Timeline

Published: Sep 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-352188.8Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has netw CVE-2021-352194.9ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.CVE-2021-35225.5GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.CVE-2021-352207.2Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.CVE-2021-352218.1Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts S CVE-2021-352229.6This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Ale CVE-2021-352238.8The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with CVE-2021-352256.4Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all tha CVE-2021-352266.5An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Ex CVE-2021-352277.8The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.CVE-2021-352284.7This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific sectio CVE-2021-352296.1Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL que