Critical Authentication Bypass in SolarWinds Orion API (CVE-2020-10148)

Rapid7

Critical Authentication Bypass in SolarWinds Orion API (CVE-2020-10148)

First seen 17 Jun 2026, 12:42 UTC • •72.6

Article Content

1 / 5

Browse articles

ThreatCluster •June 18, 2026 at 12:13 UTC

•CVE-2020-10148 allows unauthenticated remote code execution via SolarWinds Orion API.
•Affected versions include 2019.4 HF 5 and 2020.2 without hotfixes.
•Immediate patching is critical due to active exploitation of this vulnerability.

The SolarWinds Orion API is vulnerable to an authentication bypass, allowing remote attackers to execute API commands without authentication. This vulnerability, identified as CVE-2020-10148, can be exploited by appending specific parameters to the Request.PathInfo portion of a URI request. Affected versions include SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix, and 2020.2 HF 1. The vulnerability has been actively exploited in the wild, and organizations are urged to update to patched versions released in December 2020. The flaw is linked to the installation of the SUPERNOVA malware. Security advisories and mitigations have been issued, including hardening IIS servers. Users are encouraged to apply updates promptly to protect their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 140d ago How this analysis works

Timeline

2020-12-29

CVE-2020-10148 published

The vulnerability was officially published, detailing the authentication bypass in SolarWinds Orion API.

2021-01-05

First public PoC released

The first proof of concept for exploiting CVE-2020-10148 was made public, increasing the risk of attacks.

2021-11-03

CVE added to CISA KEV

CISA added CVE-2020-10148 to its Known Exploited Vulnerabilities catalog due to active exploitation.

Recent

SolarWinds updates security advisory

SolarWinds updated their advisory to track critical security issues in the Orion platform, including CVE-2020-10148.

More articles in this cluster (4)

Threat Graph

9 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
Zero-day Exploit

Organization (1)

SolarWinds

Vulnerability (1)

CVE-2020-10148

Weakness (1)

CWE-287 - Improper Authentication

Malware (1)

Supernova

Affected Platform (3)

Orion Platform
SolarWinds Orion
SolarWinds Orion Platform

Relationships

Supernova exploits CVE-2020-10148
CVE-2020-10148 targets Orion Platform
CVE-2020-10148 targets SolarWinds Orion
CVE-2020-10148 targets SolarWinds Orion Platform
Supernova targets SolarWinds
Malware targets Orion Platform
Malware targets SolarWinds Orion
Malware targets SolarWinds Orion Platform
Zero-day Exploit targets Orion Platform
Zero-day Exploit targets SolarWinds Orion
Zero-day Exploit targets SolarWinds Orion Platform
Supernova related to CWE-287 - Improper Authentication

Following this threat?

Track Supernova, SolarWinds and CVE-2020-10148 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…

Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…