Vulnerability record · CVE-2021-35217 · published 8 September 2021
CVE-2021-35217: SolarWinds Patch Manager deserialization RCE via WSAsyncExecuteTasks
Solarwinds · Patch Manager
SolarWinds Patch Manager's Orion Platform Integration module deserializes untrusted data in the WSAsyncExecuteTasks path, allowing an authenticated attacker to achieve remote code execution. The flaw is a CWE-502 insecure deserialization issue rated CVSS 3.1 8.8 (HIGH). It matters because a low-privileged network attacker can execute code with high confidentiality, integrity and availability impact.
Description
Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with network reachability and very high EPSS (0.72792) outweigh the authentication requirement and absence from KEV.
What it is
SolarWinds Patch Manager's Orion Platform Integration module deserializes untrusted data in the WSAsyncExecuteTasks path, allowing an authenticated attacker to achieve remote code execution. The flaw is a CWE-502 insecure deserialization issue rated CVSS 3.1 8.8 (HIGH). It matters because a low-privileged network attacker can execute code with high confidentiality, integrity and availability impact.
Impact
An authenticated attacker gains remote code execution on the Patch Manager/Orion Platform host, enabling full compromise of the application and its data. The CVSS vector indicates high impact to confidentiality, integrity and availability.
Attack surface
Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), per the CVSS vector. The description states an authenticated attacker exploits it through WSAsyncExecuteTasks deserialization of untrusted data.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.72792 (99.4th percentile), indicating elevated likelihood of exploitation. References are vendor advisories, release notes and a ZDI advisory; no public exploit code is cited in the record.
What to do
- Apply the SolarWinds Orion Platform 2020.2.6 (or later) update referenced in the vendor release notes and security advisory for CVE-2021-35217.
- Restrict network access to the Patch Manager/Orion Platform integration endpoints to trusted management networks only.
- Enforce least privilege and review accounts with access to the affected module, since exploitation requires authentication.
- Monitor SolarWinds advisories for further guidance and confirm the installed Patch Manager version against the fixed release.
Detection
- Monitor for unexpected child processes spawned by the Orion Platform/Patch Manager service, especially command shells or scripting hosts.
- Alert on anomalous or unexpected WSAsyncExecuteTasks requests and deserialization activity in application logs.
- Baseline and review authentication events for the Patch Manager integration module for unusual accounts or times.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm | Vendor Advisory |
| https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_relea | Release NotesVendor Advisory |
| https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-1247/ | Third Party AdvisoryVDB Entry |
| https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm | Vendor Advisory |
| https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_relea | Release NotesVendor Advisory |
| https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35217 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-1247/ | Third Party AdvisoryVDB Entry |
Track CVE-2021-35217 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-35217), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
