What’s Vulnerable › Vulnerabilities

CVE-2020-10148: SolarWinds Orion Authentication Bypass Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 92.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-29 · updated 2026-06-17
• Weakness: CWE-288

Description

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.

Affected products

• SolarWinds Orion Platform: 2019.4-hotfix5, 2020.2, 2020.2.1-hotfix1

References

• https://kb.cert.org/vuls/id/843464
• https://www.solarwinds.com/securityadvisory
• https://kb.cert.org/vuls/id/843464
• https://www.kb.cert.org/vuls/id/843464
• https://www.solarwinds.com/securityadvisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10148

Get alerted when CVE-2020-10148 or the next vulnerability affects your stack