CVE-2020-10148
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | Extreme risk. The SolarWinds SUNBURST attack was the most significant supply chain compromise in cybersecurity history, affecting US government agencies (Treasury, Commerce, DHS), Fortune 500 companies, and critical infrastructure globally. |
| Exploit ScenarioDerived | As part of the SUNBURST campaign, Russian SVR operatives compromised SolarWinds' build infrastructure to insert the SUNBURST backdoor into Orion software updates. Once installed on victim networks, the backdoor used the API authentication bypass to execute privileged operations for lateral movement and data exfiltration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
SolarWinds Orion API contains an authentication bypass that allows unauthenticated remote attackers to execute API commands, related to the massive SUNBURST supply chain attack discovered in December 2020.
Earlier versions of this analysis (1)
The SolarWinds Orion Platform API is vulnerable to authentication bypass allowing unauthenticated remote command execution, connected to the historic SUNBURST supply chain compromise attributed to Russian SVR intelligence.
RemediationAI
Update SolarWinds Orion to patched versions. Assume compromise if running affected versions during the SUNBURST campaign window (March-December 2020). Conduct thorough incident response including credential rotation and Active Directory review.
Affected ProductsAI
SolarWinds Orion Platform 2019.4 HF 5 SolarWinds Orion Platform 2020.2 with no hotfix SolarWinds Orion Platform 2020.2 HF 1
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-288 authentication bypass allows attackers to invoke privileged Orion API commands without credentials. This vulnerability was part of the broader SUNBURST campaign where SolarWinds build systems were compromised to distribute backdoored Orion updates to 18,000+ organizations.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.
Executive ViewAI
Organizations using SolarWinds Orion API face critical risk from CVE-2020-10148 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB