CVE-2021-35218: SolarWinds Orion Platform Web Console deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityNetwork-reachable deserialization leading to RCE with high EPSS and public technical detail, though not in KEV and requiring low privileges.

What it is

The Web Console Chart endpoint in SolarWinds Orion Platform deserializes untrusted data, allowing remote code execution. An attacker with network access to the Patch Manager Web Console can exploit this to compromise the server. The flaw is a classic CWE-502 unsafe deserialization issue in a network-facing component.

Impact

Successful exploitation lets an attacker execute arbitrary code on the Orion server, leading to full compromise of the host and potentially the broader management environment. Confidentiality, integrity and availability are all rated high.

Attack surface

Reached over the network via the Web Console Chart endpoint; the CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N). The description calls the attacker unauthorized, so the practical requirement is network access plus whatever low-privilege access the endpoint accepts.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is very high (0.764, 99.5th percentile), and references include a ZDI advisory, indicating public technical detail exists, but the record does not confirm active exploitation.

What to do

• Apply the vendor patch referenced in the SolarWinds Patch Manager 2020.2.6 release notes and trust-center advisory for CVE-2021-35218.
• Restrict network access to the Orion Patch Manager Web Console to trusted management networks and administrative hosts.
• Enforce least privilege on accounts that can reach the Web Console and remove unnecessary low-privilege access.
• Monitor and, where feasible, block deserialization-heavy requests to the Chart endpoint at the web tier or WAF.
• Review the ZDI-21-1248 advisory for additional vendor-recommended hardening.

Detection

• Alert on anomalous or unexpected POST/GET requests to the Web Console Chart endpoint, especially from non-administrative sources.
• Monitor Orion server processes for unexpected child processes or command execution spawned by the web console.
• Watch for outbound connections from the Orion server to unfamiliar hosts that could indicate post-exploitation activity.
• Correlate web console access logs with authentication events to spot low-privilege accounts touching the Chart endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.