What’s Vulnerable › Vulnerabilities

CVE-2024-0692: SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 92.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-01 · updated 2026-06-17
• Weakness: CWE-502

Description

The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution.

Affected products

• SolarWinds Security Event Manager: before 2023.4.1 — fixed in 2023.4.1

How to fix

Upgrade to a fixed version: SolarWinds Security Event Manager 2023.4.1. Check the vendor advisory for mitigations.

References

• https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2023-4-1_release_notes.htm
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-0692
• https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2023-4-1_release_notes.htm
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-0692

Get alerted when CVE-2024-0692 or the next vulnerability affects your stack