CVE-2021-31474

What it actually does

CVE-2021-31474 is an unauthenticated remote code execution vulnerability in SolarWinds Network Performance Monitor 2020.2.1 caused by unsafe deserialization in the SolarWinds.Serialization library. A remote attacker can send specially crafted serialized data to an exposed vulnerable service or endpoint, causing the application to deserialize attacker-controlled content and execute arbitrary code. Successful exploitation runs with SYSTEM privileges, giving the attacker full control of the underlying Windows host and the ability to read, modify, or destroy data and pivot further into the network.

Why it matters to the business

A successful compromise of SolarWinds Network Performance Monitor can be operationally severe because NPM commonly has broad visibility into network infrastructure, credentials, monitoring integrations, and internal topology. An attacker gaining SYSTEM-level access could disable monitoring, steal configuration data, harvest credentials, disrupt network operations, or use the server as a trusted foothold for lateral movement. Although this issue is not listed in CISA KEV and no ransomware association is indicated, its CVSS 9.8 severity and very high EPSS score indicate that internet-exposed or broadly reachable deployments should be treated as high priority for remediation.

How an attack unfolds

An attacker first identifies a SolarWinds Network Performance Monitor deployment running the vulnerable 2020.2.1 version or an associated vulnerable Orion component. Because authentication is not required, the attacker can interact directly with the exposed service or endpoint. The attacker then sends crafted serialized input that is processed by the SolarWinds.Serialization library. Due to insufficient validation of untrusted data, the application deserializes attacker-controlled content in a way that leads to code execution. The code executes as SYSTEM, allowing the attacker to establish persistence, run commands, dump credentials, stage tooling, tamper with monitoring functions, and pivot to other internal systems reachable from the SolarWinds server.

How to fix it

Upgrade SolarWinds Network Performance Monitor and the underlying SolarWinds Orion Platform components to a vendor-supported fixed release according to the official SolarWinds advisory. Because no exact fixed version was provided in the input, organizations should not remain on NPM 2020.2.1 and should validate the currently installed version against SolarWinds release notes and hotfix guidance. If immediate upgrade is not possible, restrict network access to SolarWinds services to trusted administrative and monitoring networks only, block internet exposure, enforce host firewall rules, monitor for abnormal child processes from SolarWinds services, and ensure the Windows host and SolarWinds service accounts are least-privileged where possible. Treat mitigation as temporary; the durable fix is vendor patching or upgrade.

How to confirm the fix worked

Confirm that SolarWinds Network Performance Monitor is no longer running version 2020.2.1 or any vendor-identified vulnerable Orion component. Validate installed product and module versions through the SolarWinds web console, installed programs inventory, SolarWinds diagnostics, and file/product version metadata on SolarWinds binaries. Verify that SolarWinds services have restarted successfully after patching and that no unsupported hotfix state remains. From a network perspective, confirm that SolarWinds management interfaces and services are not exposed to untrusted networks. Run a credentialed vulnerability scan or vendor-supported audit against the host to confirm the vulnerable version is no longer detected.

Typical attack path

1. Discover a SolarWinds Network Performance Monitor or Orion deployment reachable over the network.
2. Fingerprint the deployment to determine whether it is running the vulnerable 2020.2.1 release or affected component versions.
3. Send crafted serialized data to the vulnerable service or endpoint without authenticating.
4. Trigger unsafe deserialization in the SolarWinds.Serialization library.
5. Execute attacker-controlled code in the context of SYSTEM on the Windows host.
6. Use SYSTEM-level access to deploy tools, create persistence, collect credentials or configuration data, and move laterally through the environment.
7. Optionally tamper with or disable monitoring to reduce detection.

How to detect it

To determine whether exploitation already occurred, review SolarWinds application logs, IIS logs if the Orion web interface is involved, Windows Security logs, Sysmon or EDR process telemetry, PowerShell logs, scheduled task logs, service creation events, and outbound network connection records from the SolarWinds server. Focus on suspicious activity around SolarWinds service accounts and processes, especially unexpected child processes spawned by SolarWinds binaries such as command shells, PowerShell, script interpreters, download utilities, archive tools, or credential dumping tools. Look for unauthenticated requests followed by deserialization errors, application crashes, unusual 500 responses, or abrupt service restarts. On Windows, review Event ID 4688 for process creation, 4624 for unusual logons, 4672 for privileged logons, 4697 and 7045 for new services, 4698 for scheduled task creation, 1102 for log clearing, and PowerShell operational logs for encoded or remote-download commands. File-system review should include recently created executables, web-accessible files, unexpected DLLs in SolarWinds directories, persistence in startup folders, new local administrators, and unusual outbound connections from SolarWinds processes. Because public exploit maturity is listed as none and no KEV listing is present, absence of known campaign IOCs does not rule out targeted exploitation; prioritize behavioral evidence over static signatures.

• SolarWinds.Serialization
• SolarWinds.BusinessLayerHost.exe
• SolarWinds.BusinessLayerHost.exe -> cmd.exe
• SolarWinds.BusinessLayerHost.exe -> powershell.exe
• SolarWinds.BusinessLayerHost.exe -> pwsh.exe
• SolarWinds.BusinessLayerHost.exe -> wscript.exe
• SolarWinds.BusinessLayerHost.exe -> cscript.exe
• SolarWinds.BusinessLayerHost.exe -> rundll32.exe
• SolarWinds.BusinessLayerHost.exe -> regsvr32.exe
• SolarWinds.BusinessLayerHost.exe -> mshta.exe
• SolarWinds.BusinessLayerHost.exe -> certutil.exe
• SolarWinds.BusinessLayerHost.exe -> bitsadmin.exe
• SolarWinds.BusinessLayerHost.exe -> curl.exe
• SolarWinds.BusinessLayerHost.exe -> wget.exe
• C:\Program Files (x86)\SolarWinds\Orion\
• C:\ProgramData\SolarWinds\
• Event ID 4688 SolarWinds.BusinessLayerHost.exe cmd.exe
• Event ID 4688 SolarWinds.BusinessLayerHost.exe powershell.exe
• Event ID 7045
• Event ID 4698
• Event ID 1102

What your security team should do

• Prioritize upgrade or patching of all SolarWinds Network Performance Monitor 2020.2.1 systems, especially those reachable from untrusted networks.
• Inventory all SolarWinds Orion/NPM servers and confirm their exact product, module, and hotfix versions against SolarWinds security advisories.
• Immediately restrict access to SolarWinds web and service ports to trusted administrative sources until patching is complete.
• Review endpoint telemetry for SolarWinds service processes spawning shells, scripting engines, credential tools, archive utilities, or outbound network utilities.
• Hunt historical logs for unauthenticated requests followed by application errors, service crashes, new process creation, new local users, scheduled tasks, or suspicious outbound connections from the SolarWinds server.
• Rotate credentials stored in or accessible from SolarWinds if exploitation is suspected, including SNMP strings, device credentials, API keys, and service account secrets.
• Ensure EDR coverage, Windows event logging, PowerShell logging, and centralized log forwarding are enabled on SolarWinds servers.
• If compromise indicators are found, isolate the host, preserve forensic evidence, perform incident response, and rebuild from trusted media after credential rotation.