CVE-2021-35215

What it actually does

CVE-2021-35215 is an authenticated insecure deserialization vulnerability in SolarWinds Orion Platform 2020.2.5. A low-privileged authenticated user can submit crafted serialized data that the Orion application deserializes without sufficient validation, allowing attacker-controlled objects or execution paths to run on the Orion server. Successful exploitation can result in remote code execution with the privileges of the affected Orion service or application process, creating a path to full compromise of the monitoring server and access to sensitive monitoring data, credentials, configuration, and managed infrastructure context.

Why it matters to the business

A compromised Orion server can give an attacker a highly privileged vantage point into network, server, and application monitoring operations. Because Orion commonly stores credentials, topology data, device inventories, alerting workflows, and integrations with infrastructure tools, exploitation can lead to operational disruption, data exposure, lateral movement, and loss of trust in monitoring outputs. The CVSS score is high and the EPSS score is elevated, indicating meaningful likelihood of exploitation where exposed and unpatched, even though the vulnerability is not currently listed in CISA KEV and exploitation requires authentication.

How an attack unfolds

An attacker first obtains valid Orion credentials, such as through phishing, credential reuse, password spraying, exposed backups, or compromise of an integrated identity provider. After authenticating to the Orion Platform, the attacker sends a crafted request containing malicious serialized content to a vulnerable Orion component. The application deserializes the attacker-controlled payload in an unsafe way, causing code to execute on the Orion server. The attacker can then run commands under the Orion service context, deploy tools or web shells, dump configuration and credentials, enumerate monitored assets, pivot to managed systems, disable or manipulate monitoring, and establish persistence. Because the exploit occurs through legitimate authenticated application access, activity may initially blend with normal administrative traffic unless process execution, unusual API activity, or post-exploitation behavior is monitored.

How to fix it

Upgrade SolarWinds Orion Platform to a vendor-supported release that fixes this vulnerability; do not continue operating Orion Platform 2020.2.5. If an exact fixed version is not available in the provided advisory data, use the latest SolarWinds security advisory and upgrade path for the Orion Platform, including any required hotfixes. Until upgraded, restrict network access to Orion administrative interfaces to trusted management networks or VPNs, enforce MFA for Orion and identity-provider access, remove unnecessary Orion accounts, apply least privilege to Orion roles, rotate Orion service and stored device credentials, and monitor for suspicious child-process creation by Orion services. If exploitation is suspected, treat the Orion server as potentially compromised and perform incident response before reconnecting it to sensitive management networks.

How to confirm the fix worked

Confirm the installed Orion Platform version is no longer 2020.2.5 and matches a vendor-supported fixed release or later. Verify all SolarWinds hotfixes and platform modules are at compatible patched versions. Validate that Orion administrative interfaces are not exposed to untrusted networks and that only authorized users have login access. Review Orion application logs, Windows Event Logs, and EDR telemetry for evidence of command execution from Orion service processes before and after patching. Perform an authenticated vulnerability scan or configuration assessment to confirm the vulnerable version is no longer detected. Where possible, test that deserialization attack probes are blocked or fail safely in a non-production validation environment.

Typical attack path

1. Acquire or reuse valid credentials for an Orion Platform account.
2. Authenticate to the Orion web interface or affected Orion service endpoint.
3. Submit a crafted serialized payload to the vulnerable component.
4. Trigger unsafe deserialization and execute attacker-controlled code on the Orion server.
5. Run operating system commands under the Orion application or service account context.
6. Collect Orion configuration, stored credentials, monitored asset inventory, and integration details.
7. Move laterally to devices or systems managed or monitored by Orion.
8. Establish persistence, exfiltrate data, or disrupt monitoring and alerting workflows.

How to detect it

Look for signs that an authenticated Orion user triggered code execution or performed post-exploitation activity. Review Orion web and application logs for unusual authenticated requests, newly created accounts, role changes, suspicious administrative activity, and access from unexpected IP addresses. Review Windows Security logs for anomalous logons to the Orion server, especially logon events tied to Orion service accounts or uncommon administrator accounts. Review Sysmon, EDR, and Windows process creation telemetry for Orion service or IIS worker processes spawning command shells, PowerShell, Windows Script Host, mshta, rundll32, regsvr32, certutil, bitsadmin, curl, wget, or archive utilities. Check for suspicious files written under Orion web or application directories, temporary directories, user profile staging locations, and scheduled task persistence. Review outbound network connections from Orion servers to unfamiliar external IPs, file-sharing services, paste sites, command-and-control infrastructure, or internal systems not normally managed by Orion. If available, compare Orion audit activity with identity-provider logs to identify credential compromise preceding exploitation. Because no public exploit maturity was provided, prioritize behavioral detections over payload-specific signatures.

• SolarWinds.BusinessLayerHost.exe spawning cmd.exe
• SolarWinds.BusinessLayerHost.exe spawning powershell.exe
• SolarWinds.BusinessLayerHost.exe spawning pwsh.exe
• SolarWinds.BusinessLayerHost.exe spawning wscript.exe
• SolarWinds.BusinessLayerHost.exe spawning cscript.exe
• SolarWinds.BusinessLayerHost.exe spawning mshta.exe
• SolarWinds.BusinessLayerHost.exe spawning rundll32.exe
• SolarWinds.BusinessLayerHost.exe spawning regsvr32.exe
• SolarWinds.BusinessLayerHost.exe spawning certutil.exe
• SolarWinds.BusinessLayerHost.exe spawning bitsadmin.exe
• SolarWinds.InformationService.ServiceV3.exe spawning cmd.exe
• SolarWinds.InformationService.ServiceV3.exe spawning powershell.exe
• SolarWinds.InformationService.ServiceV3.exe spawning wscript.exe
• SolarWinds.InformationService.ServiceV3.exe spawning cscript.exe
• SolarWinds.Collector.Service.exe spawning cmd.exe
• SolarWinds.Collector.Service.exe spawning powershell.exe
• w3wp.exe spawning cmd.exe on an Orion server
• w3wp.exe spawning powershell.exe on an Orion server
• C:\Program Files (x86)\SolarWinds\Orion\*.aspx created or modified unexpectedly
• C:\Program Files (x86)\SolarWinds\Orion\*.ashx created or modified unexpectedly
• C:\ProgramData\SolarWinds\Logs\Orion\
• C:\Windows\Temp\*.ps1 created by a SolarWinds service process
• C:\Windows\Temp\*.bat created by a SolarWinds service process
• C:\Windows\Temp\*.exe created by a SolarWinds service process

What your security team should do

• Prioritize patching or upgrading any SolarWinds Orion Platform 2020.2.5 deployment because exploitation can lead to authenticated remote code execution on a high-value monitoring server.
• Inventory all Orion servers and modules, including standby, lab, disaster recovery, and offline instances, and verify their installed versions.
• Restrict Orion access to trusted administrative networks and require MFA for all interactive access.
• Audit Orion accounts, remove stale users, and reduce privileges for non-administrative roles.
• Rotate credentials stored in Orion and credentials used by Orion service accounts if the server may have been exposed or suspicious activity is found.
• Hunt for Orion service processes spawning command shells, scripting engines, file transfer utilities, or credential-dumping tools.
• Review successful and failed Orion logins for unusual source IPs, impossible travel, password spraying, and access by dormant accounts.
• Preserve logs and forensic artifacts before remediation if exploitation is suspected.
• Add detections for suspicious child processes from SolarWinds services and unusual outbound connections from Orion servers.
• Segment Orion servers from general user networks and limit their outbound access to required management destinations only.