{"id":"CVE-2022-36958","published":"2022-10-20T20:10:01Z","modified":"2025-05-08T13:25:48Z","title":"SolarWinds Platform Deserialization of Untrusted Data","vendor":"SolarWinds","product":"SolarWinds Platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"SolarWinds","product":"SolarWinds Platform","versions":[">= unspecified, <= 2022.3 and prior versions"]},{"vendor":"SolarWinds","product":"Orion Platform","versions":[">= unspecified, <= 2020.2.6 HF5 and prior versions"]}],"description":{"text":"SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.","provenance":"source","from":"CVE.org"},"summary":{"text":"The SolarWinds Platform contains a deserialization of untrusted data flaw in its Web Console component. An attacker with valid access to the SolarWinds Web Console can remotely execute arbitrary commands, and the attack requires only low-privileged authenticated access with no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:42Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.81542,"percentile":0.99639,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"},{"name":"SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)","url":"https://otx.alienvault.com/pulse/67c6bb5aa601e91b1314ff44","created":"2025-03-04"},{"name":"Thor Linux Lite Scan - Sample Device & SG2 - 02.07.25 - Unenriched","url":"https://otx.alienvault.com/pulse/67a219f7c06d372f86335d64","created":"2025-02-04"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36958","tags":[]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-CAN-17567","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-39615","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39615","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-10-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-36958","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":28.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9964"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}