Live › vulnerability › CVE-2020-10148
Go to dashboardSolarWinds Orion API has an authentication bypass that lets a remote attacker run API commands without logging in. It is on CISA's known-exploited list and EPSS rates exploitation probability at 0.920.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SolarWinds Orion | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply updates per vendor instructions; the sources do not name the fixed Orion version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2020-10148")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.