CVE-2021-35216

What it actually does

This vulnerability is an authenticated remote code execution flaw caused by insecure deserialization of untrusted data in the SolarWinds Patch Manager Orion Platform Integration module. A low-privileged authenticated user with HTTP network access can submit a crafted serialized payload that the application deserializes and executes in the context of the affected Patch Manager/Orion integration service. Successful exploitation can provide full confidentiality, integrity, and availability impact on the application host and may allow command execution, credential access, service manipulation, and lateral movement from the compromised server.

Why it matters to the business

Compromise of a patch-management platform is operationally significant because the system commonly has broad visibility into endpoints and may hold administrative credentials or deployment permissions. An attacker who gains code execution on this server could disrupt patching operations, tamper with software deployment workflows, steal credentials, pivot into managed systems, or use the trusted management infrastructure to expand access. Although this issue is not listed in CISA KEV and no mature public exploit is indicated in the provided data, the high EPSS score suggests meaningful exploitation likelihood and warrants priority remediation for internet-exposed or broadly reachable deployments.

How an attack unfolds

An attacker first obtains valid credentials for the affected SolarWinds Patch Manager environment or compromises an account with access to the Orion integration interface. From a network position that can reach the HTTP service, the attacker sends a crafted request containing malicious serialized data to the vulnerable integration module. The server accepts the request and deserializes attacker-controlled content without sufficient validation, causing attacker-supplied code or commands to execute under the identity of the application or service account. After achieving execution, the attacker typically enumerates local privileges, retrieves configuration data or stored credentials, deploys additional tooling, creates persistence, and attempts lateral movement into systems managed by the patch-management platform.

How to fix it

Upgrade SolarWinds Patch Manager and associated Orion Platform integration components to a vendor-supported version that includes the fix for this vulnerability. No exact fixed version was provided in the input, so administrators should consult the SolarWinds security advisory and upgrade to the latest supported release applicable to their deployment. If immediate upgrade is not possible, restrict HTTP access to the Patch Manager/Orion integration interface to trusted administrative networks only, enforce strong authentication and least-privilege roles, disable or isolate the Orion integration module if it is not required, and monitor for suspicious child processes or unexpected administrative activity from the Patch Manager server. Rotate credentials stored or used by the platform if exploitation is suspected.

How to confirm the fix worked

Confirm that all SolarWinds Patch Manager instances and Orion integration components are inventoried and running a vendor-fixed or latest supported version. Validate that the vulnerable integration endpoints are not reachable from untrusted networks and that access is limited to authorized administrative users. Review application version information, installed hotfixes, file build numbers, and vendor update history. Where safe and authorized, perform an authenticated vulnerability scan or vendor-recommended validation check against the Patch Manager server. After remediation, verify that the service no longer accepts vulnerable deserialization payloads and that no unexpected command execution occurs from the Patch Manager or Orion service processes.

Typical attack path

1. Obtain or compromise valid credentials for an account that can access the SolarWinds Patch Manager Orion integration over HTTP.
2. Confirm network reachability to the affected Patch Manager/Orion integration service.
3. Send a crafted serialized payload to the vulnerable integration component.
4. Trigger unsafe deserialization on the server and execute commands under the service account context.
5. Enumerate host privileges, local configuration files, application secrets, and reachable management targets.
6. Establish persistence or deploy additional tooling if privileges allow.
7. Use stolen credentials or trusted patch-management connectivity to move laterally or impact managed endpoints.

How to detect it

Investigate whether exploitation already occurred by correlating SolarWinds Patch Manager and Orion application logs, web/IIS access logs, Windows Security logs, PowerShell logs, EDR telemetry, and network egress records from affected servers. Focus on authenticated HTTP requests to Patch Manager/Orion integration functions followed by unusual server-side behavior, especially child processes launched by SolarWinds or Patch Manager services. Review Windows Event ID 4688 for process creation, 7045 for new service installation, 4697 for service creation where enabled, 4624/4627 for unusual logons, 4672 for special privilege assignment, 4103/4104 for PowerShell activity, and Sysmon events for process creation, network connections, file creation, and registry persistence. Look for command interpreters, PowerShell, WMI, rundll32, regsvr32, certutil, bitsadmin, or mshta executing from service accounts or from parent processes associated with SolarWinds/Patch Manager. Examine the server for newly created local users, scheduled tasks, services, web shells, modified application files, suspicious temporary files, outbound connections to unknown hosts, and unauthorized patch or software deployment jobs. If any indicators are found, preserve logs and disk artifacts before containment and rotate credentials used by the platform.

• SolarWinds.BusinessLayerHost.exe -> cmd.exe
• SolarWinds.BusinessLayerHost.exe -> powershell.exe
• SolarWinds.BusinessLayerHost.exe -> wscript.exe
• SolarWinds.BusinessLayerHost.exe -> cscript.exe
• SolarWinds.BusinessLayerHost.exe -> mshta.exe
• SolarWinds.BusinessLayerHost.exe -> rundll32.exe
• SolarWinds.BusinessLayerHost.exe -> regsvr32.exe
• SolarWinds.BusinessLayerHost.exe -> certutil.exe
• SolarWinds.BusinessLayerHost.exe -> bitsadmin.exe
• EminentWare.Service.exe -> cmd.exe
• EminentWare.Service.exe -> powershell.exe
• EminentWare.Service.exe -> wmic.exe
• EminentWare.Service.exe -> certutil.exe
• EminentWare.Service.exe -> bitsadmin.exe
• powershell -enc
• powershell -EncodedCommand
• certutil -urlcache
• bitsadmin /transfer
• schtasks /create
• sc create
• Event ID 7045
• Event ID 4688

What your security team should do

• Prioritize remediation for any SolarWinds Patch Manager deployment reachable from user networks, VPN segments, or the internet.
• Upgrade to the vendor-fixed or latest supported SolarWinds Patch Manager and Orion integration release as soon as possible.
• Restrict access to Patch Manager and Orion integration HTTP interfaces to dedicated administrative networks and approved jump hosts.
• Review all accounts with access to Patch Manager and remove unnecessary privileges.
• Hunt for suspicious process creation, PowerShell execution, credential dumping, service creation, and outbound connections from Patch Manager servers.
• Rotate privileged credentials used by Patch Manager if compromise cannot be ruled out.
• Enable centralized logging for web access logs, SolarWinds application logs, Windows Security events, PowerShell logs, and endpoint detection telemetry on Patch Manager hosts.
• Create detections for command shells or scripting engines spawned by SolarWinds or Patch Manager service processes.
• Review patch-management deployment activity for unauthorized packages, scripts, or configuration changes.