CVE-2022-38111

What it actually does

This is an authenticated deserialization-of-untrusted-data vulnerability in SolarWinds Platform/Orion Web Console functionality. A remote attacker who already has Orion administrator-level access can submit crafted serialized data that the application deserializes unsafely, allowing arbitrary command execution on the SolarWinds application server in the security context of the affected service. Because the vulnerable component is reachable over the network and does not require user interaction, successful exploitation can result in full compromise of confidentiality, integrity, and availability of the SolarWinds server and potentially connected monitoring infrastructure. Note: the supplied affected-product metadata references randombit/botan, which appears inconsistent with the vulnerability description; remediation should be validated against the authoritative vendor advisory for the actually deployed product.

Why it matters to the business

Compromise of a SolarWinds monitoring platform can be high impact because these systems often have broad visibility into infrastructure, stored credentials, network maps, alerting workflows, and administrative integrations. Although exploitation requires an attacker to already possess Orion administrator privileges, that requirement may be met through stolen credentials, phishing, session theft, or prior compromise. The high EPSS score indicates meaningful likelihood of exploitation activity despite the absence of CISA KEV listing, so organizations running affected SolarWinds Platform versions should prioritize patching and post-compromise review. A successful attack could lead to monitoring disruption, credential exposure, lateral movement, tampered alerts, and loss of trust in operational visibility.

How an attack unfolds

An attacker first obtains SolarWinds Orion administrator-level access, typically through credential theft, reuse of exposed credentials, phishing, compromise of an administrator workstation, or abuse of an existing privileged session. The attacker then authenticates to the SolarWinds Web Console and reaches vulnerable functionality that accepts serialized input. By sending a specially crafted serialized payload, the attacker causes the server-side application to deserialize attacker-controlled data and execute commands. Those commands may be used to establish persistence, run PowerShell or command-shell payloads, dump credentials, modify monitoring configuration, disable or suppress alerts, stage tools, or pivot to systems integrated with the monitoring platform. Because this is post-authentication remote code execution, evidence may appear as legitimate administrator web activity followed by unusual child processes, script execution, service changes, or outbound network connections from the SolarWinds server.

How to fix it

Apply the SolarWinds vendor update that remediates CVE-2022-38111 for all affected SolarWinds Platform/Orion deployments. If using source or package metadata from the supplied affected-products list, verify applicability carefully because the listed randombit/botan fixed commit, 15dc32f12d05e99a267f0fc47d88b678b71b8b05, does not align with the SolarWinds Platform description. Treat the vendor advisory and installed product version as authoritative. Until patching is complete, restrict SolarWinds Web Console access to trusted administrative networks, enforce MFA for all administrator accounts, review and reduce Orion administrator membership, disable unused accounts, rotate credentials used by the platform, and monitor for unusual command execution from SolarWinds services. If compromise is suspected, rebuild or restore the SolarWinds server from trusted media after collecting forensic evidence and rotate credentials that may have been accessible to the platform.

How to confirm the fix worked

Confirm the installed SolarWinds Platform/Orion version is at or above the vendor-fixed release for this vulnerability, and verify that no vulnerable nodes remain through software inventory, console version checks, and vulnerability scanning. Validate that Web Console access is restricted, administrator accounts require MFA, and least-privilege role assignments are enforced. On patched systems, perform authenticated configuration review to confirm the update was applied successfully and that services restarted cleanly. If using software composition analysis for the supplied package metadata, confirm the randombit/botan source revision includes commit 15dc32f12d05e99a267f0fc47d88b678b71b8b05, but do not treat that as evidence of SolarWinds remediation unless the asset actually uses that package. Review application and operating-system logs around the time prior to patching for administrator logins followed by unusual process creation or configuration changes.

Typical attack path

1. Acquire or steal credentials for a SolarWinds Orion administrator account.
2. Authenticate to the SolarWinds Web Console over the network.
3. Interact with vulnerable functionality that processes serialized data.
4. Submit a crafted serialized payload designed to trigger server-side command execution.
5. Execute operating-system commands under the SolarWinds service account context.
6. Deploy follow-on tooling, create persistence, access stored credentials, alter monitoring rules, or move laterally to connected systems.
7. Clean up web, application, or operating-system artifacts to reduce visibility.

How to detect it

Look for evidence of authenticated administrator access to the SolarWinds Web Console followed by abnormal server-side execution. Relevant sources include SolarWinds/Orion Web Console logs, SolarWinds application logs, Windows Security logs, Sysmon or EDR process telemetry, IIS logs if applicable, PowerShell operational logs, Windows service-control logs, scheduled-task logs, and outbound firewall/proxy/DNS telemetry from the SolarWinds server. Prioritize events where Orion web or service processes spawn command interpreters, scripting engines, LOLBins, archive tools, or network utilities. Investigate administrator logins from unusual IP addresses, impossible travel, new user agents, off-hours access, repeated failed logins followed by success, newly created Orion administrator accounts, modified alerting rules, disabled polling, altered notification actions, and unexpected changes to scripts or integrations. For host forensics, review new or modified files in SolarWinds application directories and Windows temporary directories, unexpected scheduled tasks or services, PowerShell encoded commands, credential-dumping indicators, and outbound connections to unfamiliar IPs or domains. Because exploitation requires admin-level Orion access, identity and session telemetry is as important as payload detection.

• SolarWinds.BusinessLayerHost.exe spawning cmd.exe
• SolarWinds.BusinessLayerHost.exe spawning powershell.exe
• SolarWinds.BusinessLayerHost.exe spawning pwsh.exe
• SolarWinds.BusinessLayerHost.exe spawning wscript.exe
• SolarWinds.BusinessLayerHost.exe spawning cscript.exe
• SolarWinds.BusinessLayerHost.exe spawning mshta.exe
• SolarWinds.BusinessLayerHost.exe spawning rundll32.exe
• SolarWinds.BusinessLayerHost.exe spawning regsvr32.exe
• SolarWinds.BusinessLayerHost.exe spawning certutil.exe
• SolarWinds.BusinessLayerHost.exe spawning bitsadmin.exe
• SolarWinds.BusinessLayerHost.exe spawning schtasks.exe
• SolarWinds.BusinessLayerHost.exe spawning net.exe
• SolarWinds.BusinessLayerHost.exe spawning net1.exe
• SolarWinds.BusinessLayerHost.exe spawning whoami.exe
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning mshta.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning certutil.exe
• powershell.exe -enc
• powershell.exe -EncodedCommand
• pwsh.exe -EncodedCommand
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• cmd.exe /c net localgroup
• schtasks /create
• sc.exe create
• certutil.exe -urlcache
• bitsadmin /transfer
• C:\Program Files (x86)\SolarWinds\Orion\
• C:\Program Files\SolarWinds\Orion\
• C:\ProgramData\SolarWinds\
• C:\Windows\Temp\
• C:\Users\Public\
• Microsoft-Windows-PowerShell/Operational Event ID 4104
• Windows Security Event ID 4688
• Windows Security Event ID 4698
• Windows Security Event ID 7045
• Sysmon Event ID 1
• Sysmon Event ID 3
• Sysmon Event ID 11

What your security team should do

• Prioritize patch verification on all SolarWinds Platform/Orion servers because the vulnerability enables authenticated remote command execution with high impact and has a high EPSS score.
• Immediately inventory SolarWinds Platform exposure, including internet-facing or broadly reachable Web Console endpoints, and restrict access to administrative networks or VPN-only paths.
• Audit all Orion administrator accounts, remove unnecessary privileges, enforce MFA, and rotate credentials for privileged users and service accounts associated with the platform.
• Hunt for historical exploitation by correlating SolarWinds administrator logins with suspicious child processes such as PowerShell, cmd.exe, wscript.exe, cscript.exe, certutil.exe, rundll32.exe, mshta.exe, or encoded command execution on the SolarWinds server.
• Review monitoring configuration for tampering, including disabled alerts, altered polling settings, new accounts, new integrations, modified scripts, or unexpected scheduled jobs.
• If suspicious activity is identified, perform incident response on the SolarWinds server as a high-value management system and rotate credentials that may be stored, proxied, or used by the platform.