CVE-2023-23836

What it actually does

This is a deserialization-of-untrusted-data vulnerability in SolarWinds Platform/Orion Platform 2022.4.1. A remote attacker who already has Orion administrator-level access to the SolarWinds Web Console can cause the application to deserialize attacker-controlled data and execute arbitrary operating-system commands in the context of the SolarWinds web application/service account. Because the vulnerable component is network-accessible through the web console and requires no user interaction, successful exploitation can lead to full confidentiality, integrity, and availability impact on the SolarWinds application server and potentially connected monitoring infrastructure.

Why it matters to the business

An attacker with stolen or misused SolarWinds administrator credentials could turn the monitoring platform into a command-execution foothold. Because SolarWinds often has broad visibility and privileged connectivity across servers, network devices, and cloud integrations, compromise can enable service disruption, credential theft, lateral movement, manipulation of monitoring data, and loss of trust in operational telemetry. The vulnerability is not listed in CISA KEV and is not known to be ransomware-associated from the provided data, but the EPSS score is high, indicating meaningful exploitation likelihood and warranting prioritized remediation, especially because the issue has been public for a long time.

How an attack unfolds

An attacker first obtains Orion administrator-level access, typically through credential theft, password reuse, phishing, session hijacking, or compromise of an existing privileged account. The attacker authenticates to the SolarWinds Web Console and reaches functionality that accepts serialized data. They submit a crafted serialized payload that triggers unsafe deserialization on the server. During deserialization, the payload causes the application to invoke operating-system commands under the security context of the SolarWinds/IIS worker process or related service account. The attacker can then run discovery commands, write tools to disk, create persistence, harvest credentials or configuration secrets, pivot to monitored systems, disable or falsify monitoring, and use the SolarWinds server as a trusted internal platform for further activity.

How to fix it

Upgrade SolarWinds Platform/Orion Platform from version 2022.4.1 to a vendor-supported release that includes the fix for this vulnerability. If exact fixed versions are not available in internal patch tooling, consult the SolarWinds security advisory and install the latest supported SolarWinds Platform release or cumulative hotfix applicable to the deployment. As compensating controls until upgrade is complete, restrict SolarWinds Web Console access to trusted administrative networks or VPNs, enforce MFA for all Orion administrator accounts, review and reduce Orion administrative privileges, disable or remove unused admin accounts, monitor for anomalous administrator activity, and ensure the SolarWinds server cannot make unnecessary outbound connections. Because exploitation requires high privileges, credential hygiene and privileged access controls are critical mitigations but should not be treated as substitutes for patching.

How to confirm the fix worked

Confirm the installed SolarWinds Platform/Orion Platform version is not 2022.4.1 and is at or above the vendor-fixed release or latest supported release. Validate through the SolarWinds web console About/version page, installed product inventory, Windows installed-programs inventory, and SolarWinds update/hotfix status. Verify the relevant SolarWinds services have been restarted after patching and that all web nodes/additional polling engines in the deployment are updated consistently. Confirm administrative access to the web console is restricted, MFA is enforced for Orion administrators, and no stale privileged accounts remain. Review application and Windows logs around the patch window to ensure no suspicious command execution occurred before remediation.

Typical attack path

1. Acquire valid SolarWinds Orion administrator-level credentials or an active privileged session.
2. Authenticate remotely to the SolarWinds Web Console.
3. Identify and access the vulnerable server-side functionality that processes serialized data.
4. Submit a crafted serialized object/payload that is accepted by the application.
5. Trigger unsafe deserialization and arbitrary command execution on the SolarWinds server.
6. Execute reconnaissance commands to identify host privileges, network reachability, stored credentials, and connected systems.
7. Deploy persistence or additional tooling, such as scheduled tasks, scripts, web shells, or remote-access utilities.
8. Use SolarWinds' trusted position and integrations to move laterally, access monitored assets, or disrupt/falsify monitoring.

How to detect it

To determine whether exploitation already occurred, correlate SolarWinds web console authentication and administrator activity with IIS access logs, SolarWinds application logs, Windows Security process-creation events, Sysmon telemetry, PowerShell logs, and EDR alerts. Focus on successful administrator logins followed shortly by unusual HTTP POST activity, deserialization or application exceptions, new files written under SolarWinds or web directories, or child processes spawned by IIS/SolarWinds service processes. Investigate any instance where w3wp.exe or SolarWinds service executables launch cmd.exe, powershell.exe, pwsh.exe, certutil.exe, bitsadmin.exe, mshta.exe, rundll32.exe, regsvr32.exe, wscript.exe, cscript.exe, or other living-off-the-land binaries. Review Windows Event ID 4688 or Sysmon Event ID 1 for command execution, PowerShell Event IDs 4103/4104 for script content, IIS logs for suspicious authenticated requests to the Orion web console, and SolarWinds logs for errors indicating serialization/deserialization failures. Also hunt for post-exploitation artifacts: unauthorized Orion admin changes, new local users, new services, scheduled tasks, unexpected web-accessible files, credential dumping tools, outbound connections to unfamiliar IPs/domains, disabled monitoring alerts, or unusual changes to monitored node configurations.

• C:\ProgramData\SolarWinds\Logs\Orion\
• C:\inetpub\logs\LogFiles\
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> cscript.exe
• ParentImage=*\w3wp.exe Image=*\cmd.exe
• ParentImage=*\w3wp.exe Image=*\powershell.exe
• ParentImage=*\w3wp.exe Image=*\pwsh.exe
• ParentImage=*\w3wp.exe Image=*\certutil.exe
• ParentImage=*\w3wp.exe Image=*\bitsadmin.exe
• ParentImage=*\w3wp.exe Image=*\mshta.exe
• ParentImage=*\w3wp.exe Image=*\rundll32.exe
• ParentImage=*\w3wp.exe Image=*\regsvr32.exe
• EventCode=4688 ParentProcessName=*\w3wp.exe NewProcessName=*\cmd.exe
• EventCode=4688 ParentProcessName=*\w3wp.exe NewProcessName=*\powershell.exe
• EventCode=1 ParentImage=*\w3wp.exe Image=*\cmd.exe
• EventCode=1 ParentImage=*\w3wp.exe Image=*\powershell.exe
• Event ID 4104
• Event ID 4103
• SolarWinds.BusinessLayerHost.exe -> cmd.exe
• SolarWinds.BusinessLayerHost.exe -> powershell.exe
• ParentImage=*\SolarWinds.BusinessLayerHost.exe Image=*\cmd.exe
• ParentImage=*\SolarWinds.BusinessLayerHost.exe Image=*\powershell.exe

What your security team should do

• Prioritize patching or upgrading any SolarWinds Platform/Orion Platform 2022.4.1 deployment, especially internet-exposed or broadly reachable web consoles.
• Immediately audit Orion administrator accounts for unknown, inactive, overprivileged, or recently modified users and rotate credentials where compromise is suspected.
• Restrict SolarWinds Web Console access to trusted administrative networks and require MFA for all privileged users.
• Hunt for suspicious child processes spawned by IIS/SolarWinds worker processes, especially command shells, PowerShell, download utilities, scripting engines, and archive tools.
• Review SolarWinds, IIS, Windows Security, Sysmon, PowerShell, and EDR telemetry for authenticated admin activity followed by unusual process creation or file writes.
• Check for persistence created after suspicious SolarWinds admin logins, including scheduled tasks, new services, startup-folder items, web shells, and unauthorized local users.
• Review outbound network connections from SolarWinds servers for unexpected destinations, command-and-control patterns, or large data transfers.
• Because EPSS is high despite no KEV listing, treat exposed or high-value deployments as elevated priority rather than deferring based solely on KEV status.