CVE-2021-35217

What it actually does

This is an authenticated remote code execution weakness caused by insecure deserialization of attacker-controlled data in the Patch Manager Orion Platform Integration module, specifically through the WSAsyncExecuteTasks execution path. A low-privileged authenticated user who can reach the vulnerable service can submit a crafted serialized payload that is deserialized by the server and executed in the context of the affected application process. Successful exploitation can provide confidentiality, integrity, and availability impact: arbitrary command execution, data access, modification of managed infrastructure workflows, or service disruption. The supplied affected-product metadata also references desktop.org/xorg/xserver GIT with a fix at commit 97c5b77774595c4dcef07223cd2684fea5201d5e; validate product applicability carefully because the vulnerability description and affected-product metadata appear inconsistent.

Why it matters to the business

If exploited, an attacker with valid credentials could turn a management integration component into a remote execution point, potentially allowing compromise of systems administered through the platform, theft of sensitive operational data, interruption of patching or monitoring workflows, and lateral movement into broader infrastructure. Although it is not listed in CISA KEV and no ransomware use is indicated, the EPSS value is high, meaning exploitation should be treated as a realistic risk for exposed or reachable deployments, especially because the issue has been public for several years.

How an attack unfolds

An attacker first obtains or reuses valid credentials for an account that can authenticate to the vulnerable management interface or service. After confirming network reachability to the Patch Manager Orion Platform Integration endpoint, the attacker sends a request that invokes the WSAsyncExecuteTasks functionality with a malicious serialized object. The vulnerable component deserializes that untrusted object without sufficient validation, type restriction, or sandboxing. During deserialization, attacker-controlled code paths are triggered, resulting in command execution under the privileges of the service account running the affected application. The attacker can then execute reconnaissance commands, drop tooling, create persistence, access configuration and credential material, pivot to managed systems, or disrupt service operations.

How to fix it

Apply the vendor-provided fixed version or commit for the affected product. For the supplied package metadata, update desktop.org/xorg/xserver GIT to a build containing commit 97c5b77774595c4dcef07223cd2684fea5201d5e or later. For Patch Manager Orion Platform Integration deployments, upgrade to the vendor-fixed release that addresses insecure deserialization in WSAsyncExecuteTasks. Remove direct internet exposure for management interfaces, restrict access to trusted administrative networks or VPNs, enforce MFA for administrative access, and ensure least-privilege service accounts. If immediate patching is not possible, disable or isolate the vulnerable integration module, block untrusted access to the affected service endpoints, monitor for suspicious authenticated requests, and rotate credentials that may have been exposed through the management platform.

How to confirm the fix worked

Confirm the installed version or source commit includes the vendor fix, specifically commit 97c5b77774595c4dcef07223cd2684fea5201d5e for the supplied GIT package metadata. For packaged deployments, verify the application build number against the vendor advisory and confirm that the Patch Manager Orion Platform Integration module is updated. Test that only trusted administrative networks can reach the service and that authentication, MFA, and role-based access controls are enforced. Review application logs for errors or requests involving WSAsyncExecuteTasks before and after remediation. Where safe and authorized, use a vulnerability scanner or vendor-provided verification method to confirm the deserialization endpoint is no longer exploitable. Do not validate by sending live exploit payloads to production systems unless using an approved, controlled test procedure.

Typical attack path

1. Obtain valid credentials through phishing, credential stuffing, password reuse, token theft, or prior compromise.
2. Identify a reachable instance of the affected Patch Manager Orion Platform Integration component or affected product build.
3. Authenticate to the vulnerable service or management interface.
4. Send a crafted request to the WSAsyncExecuteTasks deserialization path containing a malicious serialized payload.
5. Trigger unsafe server-side deserialization that executes attacker-controlled code in the application context.
6. Run post-exploitation commands to enumerate privileges, host configuration, service accounts, and reachable managed systems.
7. Establish persistence, collect sensitive data, modify patch-management operations, or move laterally into adjacent infrastructure.

How to detect it

Review application, web, authentication, and operating-system logs from systems running the affected management component. Focus on authenticated requests invoking WSAsyncExecuteTasks, especially from unusual source IPs, service accounts, newly created accounts, or accounts that do not normally perform patch-management actions. Look for application exceptions indicating failed deserialization, unexpected object types, formatter errors, or abnormal task execution. On Windows hosts, review Security Event logs, Sysmon, EDR telemetry, PowerShell logs, process creation events, scheduled task creation, service installation, and outbound network connections from the application service process. High-value artifacts include suspicious child processes spawned by the management application, encoded PowerShell commands, command shells, file downloads, archive staging, credential-dumping tools, and unauthorized changes to patching or orchestration jobs. Because no public KEV listing or ransomware association is provided, absence of known campaign indicators should not be treated as absence of compromise; prioritize behavior-based hunting around authenticated deserialization attempts and post-exploitation execution.

• WSAsyncExecuteTasks
• deserialization
• SerializationException
• System.Runtime.Serialization
• ObjectDataProvider
• BinaryFormatter
• TypeNameHandling
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin /transfer
• schtasks /create
• sc create
• net user
• net localgroup administrators
• 97c5b77774595c4dcef07223cd2684fea5201d5e

What your security team should do

• Prioritize patching or upgrading any confirmed affected deployments because the vulnerability enables authenticated remote code execution and has a high EPSS likelihood.
• Resolve the product metadata discrepancy by confirming whether the exposure is SolarWinds Patch Manager Orion Platform Integration, desktop.org/xorg/xserver, or both in asset inventory and SBOM data.
• Restrict access to management interfaces and integration endpoints to trusted administrative networks only; block internet exposure.
• Audit accounts with access to the affected service, enforce MFA, remove unnecessary privileges, and rotate credentials if exploitation is suspected.
• Search historical logs for authenticated access to WSAsyncExecuteTasks, deserialization errors, suspicious child processes, and unusual administrative actions.
• Monitor application servers for unexpected process creation, outbound network connections, new scheduled tasks, new services, web shells, or unauthorized configuration changes.
• If suspicious activity is found, isolate the affected host, preserve logs and volatile evidence, rotate service-account credentials, and investigate lateral movement to managed endpoints.