CVE-2020-12608: SolarWinds Managed Service Provider Patch Management Engine

High severity, CVSS 7.8. EPSS: 22.4% chance of exploitation in the next 30 days.

An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.

Affected products

• SolarWinds Managed Service Provider Patch Management Engine: before 1.1.15 (fixed in 1.1.15)

Published 2020-05-07. Last modified 2026-06-17.