CVE-2020-10148: SolarWinds Orion API authentication bypass allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network-reachable authentication bypass, KEV-listed, and EPSS above 0.91 make this an urgent patch-first issue.

What it is

The SolarWinds Orion Platform API contains an authentication bypass (CWE-288/CWE-306) that lets a remote, unauthenticated attacker execute API commands. Because the API is reachable over the network with no credentials or user interaction, a successful bypass can compromise the Orion instance itself. Affected versions are 2019.4 HF 5, 2020.2 without a hotfix, and 2020.2 HF 1.

Impact

An attacker gains the ability to run arbitrary API commands on the Orion server, which can lead to full compromise of the SolarWinds instance and any data or downstream systems it manages.

Attack surface

Reachable over the network via the Orion API (CVSS vector AV:N/PR:N/UI:N); no authentication or user interaction is required. The record does not describe the exact alternate path used, only that authentication can be bypassed.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.9198 (99.8th percentile), indicating active exploitation is expected. No ransomware campaign use is documented in this record.

What to do

• Apply the SolarWinds Orion hotfix/update per the vendor security advisory for the affected versions (2019.4 HF 5, 2020.2, 2020.2 HF 1).
• Restrict network access to the Orion API to trusted management networks and block it from the public internet.
• Rotate credentials and review API tokens/accounts on Orion hosts, since an authentication bypass may have exposed them.
• Monitor SolarWinds and CISA advisories for follow-up guidance and verify the installed Orion build is not one of the affected versions.

Detection

• Review Orion API access logs for requests to unusual or alternate API paths that succeed without prior authentication.
• Alert on API command execution from source IPs outside expected management ranges.
• Correlate Orion server process activity with unexpected child processes or outbound connections following API calls.
• Hunt for authentication events where API actions occur without a matching login record.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.