SolarWinds Platform (Orion)
CVE-2021-35218: Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityHIGHCVSS 3.1 8.9
EPSS76%Chance of exploitation in 30 days
Public exploitNot tracked
FixAvailable
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Patch Manager (Windows) 2020.5 and previous versions | 2020.2.6 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.