Vulnerability record · CVE-2020-12145 · published 5 November 2020

CVE-2020-12145: Silver-peak unity orchestrator improper authentication vulnerability

Silver Peak · Unity Orchestrator

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.

9.8 CVSS 3.1 Critical EPSS 6.0% · top 6.9% CWE-287 · Improper authentication

9.8CVSS 3.1 base score, v2 7.5

6.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Unity Orchestrator Silver Peak

References

Link	Tags
https://www.silver-peak.com/support/user-documentation/security-advisories	Vendor Advisory
https://www.silver-peak.com/support/user-documentation/security-advisories	Vendor Advisory

Track CVE-2020-12145 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2020-12146Silver-peak unity orchestrator path traversal vulnerabilityIn Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted fil…EPSS 28%5 Nov 2020 8.8CVE-2020-12147Silver-peak unity orchestrator path traversal vulnerabilityIn Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against t…EPSS 1.5%5 Nov 2020 4.9CVE-2020-12142Silver-peak unity edgeconnect for amazon web services exposure of resource to wrong sphere vulnerability1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such …EPSS 0.72%5 May 2020 4.9CVE-2020-12143Silver-peak unity edgeconnect for amazon web services improper certificate validation vulnerabilityThe certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connect…EPSS 0.34%5 May 2020 4.9CVE-2020-12144Silver-peak unity edgeconnect for amazon web services improper certificate validation vulnerabilityThe certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establis…EPSS 0.34%5 May 2020 7.5CVE-2026-42018JFrog Artifactory improper authentication leaks anonymous tokenJFrog Artifactory can return an internal anonymous-user token to an unauthenticated caller even when anonymous access is disabled. Because the token …KEVEPSS 9.8%analysed12 Aug 2026 9.8CVE-2026-82329JFrog Artifactory improper authentication allows admin takeoverJFrog Artifactory contains an improper authentication weakness (CWE-287) that, under default configuration, may let an unauthenticated attacker with …KEVEPSS 14%analysed28 Aug 2026 8.8CVE-2026-59822LiteLLM MCP endpoint auth bypass via OAuth2 passthrough fallbackLiteLLM's MCP Streamable HTTP endpoint, prior to 1.84.0, let an unauthenticated attacker send a fabricated Authorization header that triggered an OAu…KEVEPSS 0.84%analysed8 Jul 2026

Source: NIST National Vulnerability Database (record CVE-2020-12145), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.