CVE-2016-3643: SolarWinds Virtualization Manager sudo misconfiguration privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw yields full root compromise and is listed in CISA KEV with public exploit code, though it requires a local account and EPSS probability is modest.

What it is

SolarWinds Virtualization Manager 6.3.1 and earlier ship with a misconfigured sudo policy that lets a local user run privileged commands, as shown by the example "sudo cat /etc/passwd." Because the flaw grants full root-level read and write access, any local account on the host can take over the system.

Impact

An attacker with a local account gains root privileges, allowing full read and write access to the host, its configuration and any data the appliance can reach.

Attack surface

Reached locally by running sudo commands on the Virtualization Manager host; the CVSS vector (AV:L/PR:L/UI:N) indicates a low-privileged local account is required and no user interaction is needed.

Exploitation

CISA added this to KEV in November 2021, and public exploit code exists in Exploit-DB and Packet Storm, though EPSS 30-day probability is low at roughly 3.7 percent. No ransomware use is documented.

What to do

• Apply the vendor update that corrects the sudo configuration; this is the primary fix.
• If patching is delayed, audit and tighten /etc/sudoers and any included sudoers.d entries to remove unnecessary command grants for non-root users.
• Restrict interactive and SSH access to the Virtualization Manager host to the smallest set of administrators.
• Monitor for and remove unnecessary local accounts, and rotate credentials for any account that could log on locally.
• Where feasible, isolate the appliance on a management network with limited reach to production systems.

Detection

• Alert on sudo invocations by non-administrative accounts, especially commands such as cat /etc/passwd or shell spawns.
• Review sudoers configuration changes and compare against a known-good baseline.
• Monitor for new or modified privileged accounts and for interactive logins to the Virtualization Manager host.
• Correlate local authentication events with subsequent privileged command execution on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.