CVE-2016-3642: SolarWinds Virtualization Manager

Critical severity, CVSS 9.8. EPSS: 13.3% chance of exploitation in the next 30 days.

The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected products

• SolarWinds Virtualization Manager: up to and including 6.3.1

Published 2016-06-17. Last modified 2026-06-17.