CVE-2021-35226

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
SolarWinds	Network Configuration Manager	>= 2020.2.5 and previous version, < 2020.2.5

References

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35226Patch, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35226Patch, Vendor Advisory

Timeline

Published: Oct 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-352277.8The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.CVE-2021-352284.7This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific sectio CVE-2021-352296.1Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL que CVE-2021-35237.5A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an a CVE-2021-352306.7As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalate CVE-2021-352316.7As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain esc CVE-2021-352326.1Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web CVE-2021-352335.3The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only CVE-2021-352348.8Numerous exposed dangerous functions within Orion Core has allows for read-only SQL injection leading to privileged escalation. An attacker CVE-2021-352355.3The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web ap CVE-2021-352365.3The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to on CVE-2021-352374.3A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that