CVE-2022-38108 Public exploit High · 7.2 EPSS 65.9%

SolarWinds Platform Deserialization of Untrusted Data

SolarWinds · SolarWinds Platform

Summary

The SolarWinds Platform contains a deserialization of untrusted data flaw in its web console component. An attacker with network access and Orion admin-level account credentials can use it to execute arbitrary commands through the SolarWinds Web Console.

Official description · CVE.org

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.

Breakdown

31.8 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Metasploit) was available 1 day before disclosure.

Public exploit codeMetasploit19 Oct 20221 day before
Disclosed20 Oct 2022day 0

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 6 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag

Other 3

solarwinds.com/trust-center/security-advisories/CVE-2022-38108 zerodayinitiative.com/advisories/ZDI-CAN-17531 packetstormsecurity.com/files/171567/SolarWinds-Information-Service-SWIS-Remote-Command-Execution.html

exploit 1

packetstorm.news/files/id/171567

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-40710

Public exploitAdvisories link exploit code.

, 30 Oct 2026

65.9%Top 0.73%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.27%).

3.1

7.2High · 7.2

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9927 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 NVD exploit link; 1 Metasploit module 5.0/5

Mentioned in OTX pulses6 pulses 1.9/3

CVSS base scorebase score 7.2 5.0/7

End-of-life productsupported or unknown 0.0

Total31.8

Record

Published: 20 Oct 2022
Modified: 8 May 2025
: CWE-502 Deserialization of Untrusted Data
Elsewhere: NVD CVE.org JSON