Critical Authentication Bypass in SolarWinds Orion API (CVE-2020-10148)

Rapid7

Critical Authentication Bypass in SolarWinds Orion API (CVE-2020-10148)

First seen 17 Jun 2026, 12:42 UTC • •72.6

Article Content

1 / 5

Browse articles

ThreatCluster •June 18, 2026 at 12:13 UTC

•CVE-2020-10148 allows unauthenticated remote code execution via SolarWinds Orion API.
•Affected versions include 2019.4 HF 5 and 2020.2 without hotfixes.
•Immediate patching is critical due to active exploitation of this vulnerability.

The SolarWinds Orion API is vulnerable to an authentication bypass, allowing remote attackers to execute API commands without authentication. This vulnerability, identified as CVE-2020-10148, can be exploited by appending specific parameters to the Request.PathInfo portion of a URI request. Affected versions include SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix, and 2020.2 HF 1. The vulnerability has been actively exploited in the wild, and organizations are urged to update to patched versions released in December 2020. The flaw is linked to the installation of the SUPERNOVA malware. Security advisories and mitigations have been issued, including hardening IIS servers. Users are encouraged to apply updates promptly to protect their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 115d ago How this analysis works

Timeline

2020-12-29

CVE-2020-10148 published

The vulnerability was officially published, detailing the authentication bypass in SolarWinds Orion API.

2021-01-05

First public PoC released

The first proof of concept for exploiting CVE-2020-10148 was made public, increasing the risk of attacks.

2021-11-03

CVE added to CISA KEV

CISA added CVE-2020-10148 to its Known Exploited Vulnerabilities catalog due to active exploitation.

Recent

SolarWinds updates security advisory

SolarWinds updated their advisory to track critical security issues in the Orion platform, including CVE-2020-10148.

More articles in this cluster (4)

Threat Graph

9 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
Zero-day Exploit

Organization (1)

SolarWinds

Vulnerability (1)

CVE-2020-10148

Weakness (1)

CWE-287 - Improper Authentication

Malware (1)

Supernova

Affected Platform (3)

Orion Platform
SolarWinds Orion
SolarWinds Orion Platform

Relationships

Supernova exploits CVE-2020-10148
CVE-2020-10148 targets Orion Platform
CVE-2020-10148 targets SolarWinds Orion
CVE-2020-10148 targets SolarWinds Orion Platform
Supernova targets SolarWinds
Malware targets Orion Platform
Malware targets SolarWinds Orion
Malware targets SolarWinds Orion Platform
Zero-day Exploit targets Orion Platform
Zero-day Exploit targets SolarWinds Orion
Zero-day Exploit targets SolarWinds Orion Platform
Supernova related to CWE-287 - Improper Authentication

Following this threat?

Track Supernova, SolarWinds and CVE-2020-10148 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…