CVE-2021-31474: SolarWinds Network Performance Monitor unauthenticated deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityPre-authentication network-reachable remote code execution as SYSTEM with a CVSS of 9.8 and very high EPSS makes this an urgent patching priority.

What it is

SolarWinds Network Performance Monitor 2020.2.1 contains a deserialization of untrusted data flaw in the SolarWinds.Serialization library, caused by missing validation of user-supplied data. It is remotely reachable without authentication and allows code execution as SYSTEM, making it a severe pre-auth remote code execution issue for exposed installations.

Impact

An unauthenticated remote attacker can execute arbitrary code with SYSTEM privileges on the affected server, leading to full host compromise and potential lateral movement into monitored network infrastructure.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges (PR:N) and no user interaction (UI:N) required, per the CVSS vector and description. Any network path to the affected SolarWinds NPM service is sufficient to attempt exploitation.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.94431 (99.8th percentile), indicating elevated near-term exploitation likelihood. References are vendor release notes and a ZDI advisory, with no public exploit tag supplied.

What to do

• Apply the SolarWinds fix referenced in the SAM 2020.2.5 release notes, or upgrade to a supported release that includes the corrected SolarWinds.Serialization library.
• Restrict network access to the NPM web/service interfaces to trusted management networks; do not expose them to the internet.
• Place affected servers behind authenticated reverse proxies or VPN where operationally feasible.
• Monitor SolarWinds advisories for updated guidance and confirm the installed build is patched.
• Segment the NPM host from sensitive internal networks to limit post-exploitation movement.

Detection

• Monitor for unexpected child processes spawned by SolarWinds NPM service processes, especially command shells or scripting hosts running as SYSTEM.
• Alert on anomalous outbound network connections originating from the NPM server.
• Review NPM service and web logs for unusual deserialization-related requests or malformed payloads.
• Baseline and monitor file writes or new executables in NPM installation and temporary directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.