SolarWinds · Virtualization Manager
CVE-2016-3643
SolarWinds Virtualization Manager Privilege Escalation Vulnerability
Exploited in attacks
High 7.8 Attack chance: 3.7%
What it is
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
CISA: SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from SolarWinds
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 5, 2026 | Uncontrolled Resource Consumption | Serv-U | High 7.5 | 44% |
| Mar 9, 2026 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 90% |
| Feb 12, 2026 | Security Control Bypass | Web Help Desk | High 8.1 | 74% |
| Feb 3, 2026 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 84% |
| Oct 15, 2024 | Hardcoded Credential | Web Help Desk | Critical 9.1 | 93% |
| Aug 15, 2024 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 85% |
| Jul 17, 2024 | Path Traversal Vulnerability | Serv-U | High 8.6 | 99.6% |
| Jan 21, 2022 | Improper Input Validation | Serv-U | Medium 4.3 | 3.5% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.