CVE-2020-27871: SolarWinds Orion Platform path traversal in VulnerabilitySettings.aspx

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote pre-auth-bypass path traversal leading to SYSTEM code execution is severe, though the CVSS score is 7.2 and no KEV listing or confirmed public exploit is present.

What it is

SolarWinds Orion Platform 2020.2.1 fails to validate a user-supplied path in VulnerabilitySettings.aspx, allowing path traversal that leads to arbitrary file creation. Because the existing authentication mechanism can be bypassed, a remote attacker can reach the flaw without valid credentials. Successful exploitation yields code execution as SYSTEM, making this a serious risk for internet-exposed Orion installations.

Impact

An attacker gains the ability to create arbitrary files and ultimately execute code with SYSTEM privileges on the Orion server. That level of access can lead to full host compromise and further lateral movement into the managed environment.

Attack surface

The flaw is reached remotely over the network through VulnerabilitySettings.aspx. Authentication is nominally required, but the record states the existing authentication mechanism can be bypassed, and no user interaction is indicated by the CVSS vector.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use. EPSS is very high at 0.9083 (99.8th percentile), and the only references are ZDI advisories tagged Third Party Advisory and VDB Entry, so no public exploit code is confirmed by the supplied data.

What to do

• Apply the SolarWinds patch or upgrade that addresses CVE-2020-27871 for Orion Platform 2020.2.1.
• Restrict network access to Orion web interfaces, especially VulnerabilitySettings.aspx, to trusted management networks only.
• Enforce strong authentication and review the authentication bypass condition; do not rely on the existing mechanism alone.
• Monitor and audit file creation in Orion application and web directories for unexpected files.
• Run the Orion service with least privilege where operationally possible to limit the impact of SYSTEM-level code execution.

Detection

• Alert on POST or GET requests to VulnerabilitySettings.aspx with path traversal sequences such as ../ or encoded variants.
• Monitor for new or modified files in Orion web and application directories outside normal deployment windows.
• Watch for child processes spawned by the Orion web service or w3wp.exe, particularly command shells or scripting hosts.
• Correlate Orion server file-system changes with anomalous outbound network connections from the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.