SolarWinds · Orion
CVE-2020-10148
SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
What it is
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
CISA: SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from SolarWinds
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 5, 2026 | Uncontrolled Resource Consumption | Serv-U | High 7.5 | 44% |
| Mar 9, 2026 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 90% |
| Feb 12, 2026 | Security Control Bypass | Web Help Desk | High 8.1 | 74% |
| Feb 3, 2026 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 84% |
| Oct 15, 2024 | Hardcoded Credential | Web Help Desk | Critical 9.1 | 93% |
| Aug 15, 2024 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 85% |
| Jul 17, 2024 | Path Traversal Vulnerability | Serv-U | High 8.6 | 99.6% |
| Jan 21, 2022 | Improper Input Validation | Serv-U | Medium 4.3 | 3.5% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.