CVE-2021-35216: SolarWinds Patch Manager deserialization flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with low-privilege network reach and remote code execution impact, plus a very high EPSS score, make this a high-priority patch despite no KEV listing.

What it is

The Patch Manager Orion Platform Integration module deserializes untrusted data, allowing an authenticated attacker with network access to run code on the host. Because the flaw is reachable over HTTP and needs only low privileges, it is a serious post-authentication escalation path in a widely deployed management product.

Impact

An attacker who holds a valid low-privileged account can execute arbitrary code with the privileges of the Patch Manager service, giving full control of the affected server and its integration with the Orion platform.

Attack surface

Reached over the network via HTTP against the Patch Manager Orion Platform Integration module. Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high at 0.814 (99.6th percentile), indicating strong likelihood of exploitation activity. Vendor and ZDI references confirm a patch exists.

What to do

• Apply the SolarWinds Patch Manager 2020.2.6 update or later per the vendor advisory and release notes.
• Restrict network access to the Patch Manager and Orion integration endpoints to trusted management networks only.
• Audit and minimize accounts with access to Patch Manager; remove or disable unused low-privileged accounts.
• Monitor the integration module for unexpected outbound connections or child processes spawned by the service.
• If patching cannot be done immediately, isolate the Patch Manager server from untrusted networks.

Detection

• Alert on unusual child processes or command shells spawned by the Patch Manager or Orion integration service.
• Monitor HTTP requests to Patch Manager integration endpoints for serialized payload patterns or anomalous content types.
• Review authentication logs for low-privileged accounts accessing integration endpoints outside normal administrative workflows.
• Baseline and watch for new outbound network connections from the Patch Manager host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.