SolarWinds Patch Manager vulnerabilities

3 CVEs affecting SolarWinds Patch Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-35217, published 2021-09-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-35216, published 2021-09-01. High severity, CVSS 8.8. EPSS: 81.4% chance of exploitation in the next 30 days. Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via…
CVE-2021-35217, published 2021-09-08. High severity, CVSS 8.8. EPSS: 72.8% chance of exploitation in the next 30 days. Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker…
CVE-2021-27240, published 2021-03-29. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Patch Manager 2020.2.1. An attacker must first obtain the ability to execute low-privileged…