CVE-2022-36961: SolarWinds Orion Platform SQL injection allows privilege escalation and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS despite no KEV listing makes this a high-priority patch for exposed Orion deployments.

What it is

A component of SolarWinds Orion Platform is vulnerable to SQL injection. An authenticated attacker can use the flaw to escalate privileges or execute remote code, making it a serious risk for any internet- or network-exposed Orion deployment.

Impact

An attacker with a valid low-privileged account can escalate to higher privileges and potentially execute arbitrary code on the Orion server, compromising the monitoring platform and any credentials or managed systems it holds.

Attack surface

Reachable over the network via the vulnerable Orion component; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is very high (0.75174, 99.5th percentile), suggesting elevated likelihood of exploitation activity.

What to do

• Apply the SolarWinds Orion Platform 2022.3 release or later per the vendor advisory and release notes.
• Restrict network access to the Orion web interface and management ports to trusted networks only.
• Audit and minimize Orion accounts, removing unused or over-privileged users.
• Monitor Orion database and application logs for anomalous SQL activity and unexpected privilege changes.

Detection

• Review Orion application and database logs for SQL syntax errors, UNION statements, or unusual query patterns from web-facing accounts.
• Alert on privilege changes or new administrative accounts created in Orion outside change windows.
• Monitor for unexpected child processes or command execution spawned by Orion web or application services.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.