CVE-2021-35218

What it actually does

This vulnerability is an insecure deserialization flaw in the SolarWinds Orion Platform Patch Manager Web Console chart endpoint. An attacker with network access to the Orion Patch Manager Web Console and at least low-privileged access can submit crafted serialized data that is processed by the server. If successfully deserialized, attacker-controlled objects can execute code in the context of the web application or associated Orion server process, resulting in remote code execution. Because the affected system commonly has privileged access to monitoring and systems-management data, successful exploitation can also expose credentials, configuration data, and management integrations.

Why it matters to the business

Successful exploitation could allow an attacker to take control of a SolarWinds Orion server used for monitoring or patch-management operations. This may disrupt infrastructure monitoring, impair patch-management workflows, expose sensitive operational data, and provide a foothold for lateral movement into managed systems. Although this CVE is not currently listed in CISA KEV and no exploit maturity was provided, the high CVSS score and high EPSS probability indicate meaningful exploitation risk for internet- or broadly network-accessible Orion web consoles.

How an attack unfolds

An attacker first identifies an exposed SolarWinds Orion Patch Manager Web Console and obtains or uses low-privileged access to reach the vulnerable chart endpoint. The attacker then sends a specially crafted request containing malicious serialized data. When the web console processes the request, the server deserializes attacker-controlled content without sufficient validation. If the payload is compatible with available server-side classes and execution paths, code runs on the Orion server under the privileges of the application process. The attacker may then deploy a web shell or command-execution payload, enumerate Orion configuration and credentials, access monitoring data, alter application behavior, and use the compromised server as a staging point for further movement in the network.

How to fix it

Upgrade the SolarWinds Orion Platform and Patch Manager components to a vendor-supported release that includes the fix for CVE-2021-35218. If exact fixed versions are not available in asset records, consult the SolarWinds security advisory and apply the latest cumulative hotfix or supported platform release for the affected Orion Platform branch. Restrict access to the Orion/Patch Manager Web Console to trusted administrative networks or VPNs only, block direct internet exposure, and enforce strong authentication with least-privilege roles. Review and rotate credentials stored in or used by Orion if compromise is suspected. As compensating controls, use web application firewall rules or reverse-proxy controls to limit access to the affected console endpoints, but do not rely on these controls as a substitute for patching.

How to confirm the fix worked

Confirm the installed SolarWinds Orion Platform and Patch Manager versions are at or above the vendor-fixed release level by checking the Orion web console About page, installed program versions, and SolarWinds installer or hotfix inventory. Verify that the Orion Patch Manager Web Console is not reachable from untrusted networks and that access controls require authentication. Run authenticated vulnerability scans or vendor-provided update checks to ensure CVE-2021-35218 is no longer reported. After patching, test normal dashboard and chart functionality and confirm web console logs no longer show errors related to unsafe deserialization or rejected serialized payloads. If exposure existed before remediation, perform compromise assessment before considering the issue fully resolved.

Typical attack path

1. Identify SolarWinds Orion Platform or Patch Manager Web Console reachable over the network.
2. Authenticate with low-privileged credentials or otherwise obtain access required to reach the vulnerable chart endpoint.
3. Send a crafted request to the web console chart endpoint containing malicious serialized data.
4. Trigger server-side deserialization and execute attacker-controlled code in the Orion application context.
5. Establish persistence, commonly through a web shell, scheduled task, service, or dropped executable.
6. Enumerate Orion configuration, credentials, integrations, managed assets, and network reachability.
7. Use the Orion server foothold to exfiltrate data, disrupt monitoring, or pivot to other systems.

How to detect it

Investigate whether the Orion Patch Manager Web Console received unusual requests to chart-related endpoints, especially requests with large or abnormal POST bodies, encoded serialized objects, or deserialization error responses. Review IIS logs, SolarWinds Orion application logs, Windows Event Logs, EDR telemetry, PowerShell logs, and Sysmon data on Orion servers. Look for web server worker processes or Orion services spawning command interpreters, scripting engines, network download tools, or unexpected binaries. Examine file system changes under web-accessible directories, temporary directories, SolarWinds installation paths, and user profile temp locations for newly created ASPX files, DLLs, executables, scripts, or archives. Review authentication logs for low-privileged accounts accessing Patch Manager Web Console functions shortly before suspicious process execution. Search for outbound connections from Orion servers to unfamiliar external IPs, newly observed domains, file-sharing services, or command-and-control infrastructure. Because the vulnerability involves deserialization, also look for application errors mentioning serialization, deserialization, type loading, object state, or unexpected exceptions around chart endpoint requests.

• POST requests to Orion Patch Manager Web Console chart endpoints with unusually large request bodies
• Serialized payload markers in HTTP request bodies: "__type"
• Serialized payload markers in HTTP request bodies: "$type"
• Serialized payload markers in HTTP request bodies: "ObjectDataProvider"
• Serialized payload markers in HTTP request bodies: "LosFormatter"
• Serialized payload markers in HTTP request bodies: "BinaryFormatter"
• Serialized payload markers in HTTP request bodies: "System.Windows.Data"
• Application log messages containing "deserialization"
• Application log messages containing "SerializationException"
• Application log messages containing "TypeLoadException"
• Application log messages containing "ObjectDataProvider"
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning mshta.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning curl.exe
• w3wp.exe spawning wget.exe
• SolarWinds.BusinessLayerHost.exe spawning cmd.exe
• SolarWinds.BusinessLayerHost.exe spawning powershell.exe
• SolarWinds.BusinessLayerHost.exe spawning cscript.exe
• SolarWinds.BusinessLayerHost.exe spawning wscript.exe
• Unexpected .aspx files under SolarWinds Orion web directories
• Unexpected .ashx files under SolarWinds Orion web directories
• Unexpected .dll files under SolarWinds Orion web directories
• New files in C:\Windows\Temp created by IIS or SolarWinds service accounts
• New files in C:\inetpub\wwwroot\ created by IIS or SolarWinds service accounts

What your security team should do

• Prioritize patching or upgrading all affected SolarWinds Orion Platform and Patch Manager deployments, especially consoles reachable from broad internal networks or the internet.
• Immediately restrict Orion/Patch Manager Web Console access to trusted administrative subnets, VPNs, or privileged access gateways.
• Inventory all Orion servers and verify whether Patch Manager Web Console components are installed and enabled.
• Review web server, Orion application, Windows event, process creation, and endpoint telemetry for signs of exploitation before and after remediation.
• Hunt for suspicious child processes spawned by IIS or Orion services, including command shells, scripting engines, download utilities, and archive tools.
• Rotate Orion-related service account, database, API, and integration credentials if exploitation is suspected or cannot be ruled out.
• Increase monitoring around SolarWinds servers because they often have privileged visibility into infrastructure and can be attractive lateral-movement targets.
• Ensure Orion administrative accounts follow least privilege and require multi-factor authentication where supported.