CVE-2020-10148Active Exploitation(solarwinds / orion_platform)

LOWCVSS 9.8 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for solarwinds orion_platform systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.

solarwinds CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-05-03. Apply updates per vendor instructions.

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10148

Weakness type (CWE)

CWE-288CWE-306

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

orion_platform

Threat summary

Active exploitation appears in 3 classified signals
4 mentions across 4 observed days
Momentum state: stable

What's happening

Active exploitation reported across 3 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 3d ago at 1 mentions (2026-01-29); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

solarwinds

Products

orion_platform

3 versions affected across 1 product

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Active Exploitation

375.0%

Disclosure

125.0%

Referenced assets1 URL

By indicator

https://threatcluster.io/cluster/critical-authentication-bypass-in-solarwinds-orion-api-cve-2-03e8a682

Classification over time

Date	Total	Labels

2026-01-29	1	Active Exploitation1
2026-03-21	1	Active Exploitation1
2026-06-12	1	Disclosure1
2026-06-17	1	Active Exploitation1

Full discourse4 posts

Kat@kat_katpaints120d
Disclosure
@GGZ_71 @Mz_Informashun @FreddyLA7 1) A critical vulnerability in Dominion Democracy Suite Image Cast X system, identified as CVE-2020-10148 allowed unauthorized remote access to voting machines unpatched during the 2020 election.
Post summary
The tweet announces CVE-2020-10148 as a critical vulnerability in Dominion Democracy Suite Image Cast X, enabling unauthorized remote access to voting machines during the 2020 election, with no evidence of exploitation, PoC, patch, or false positive claim.
1000033
548 followersView on X
David@davidsheyi204d
Active Exploitation
3/ CVE-2020-10148 is one vulnerability exploited in supply chain attacks. Attackers leverage such CVEs to bypass authentication mechanisms. #DataBreach #RiskManagement
Post summary
The statement identifies CVE-2020-10148 as actively exploited in supply-chain attacks to bypass authentication mechanisms.
1000035
555 followersView on X
David@davidsheyi255d
Active Exploitation
3/ CVE-2020-10148 was one of the vulnerabilities exploited in the SolarWinds breach. This shows the importance of patch management and vulnerability scanning. #CISO #RiskManagement
Post summary
CVE-2020-10148 was exploited in the SolarWinds breach, highlighting the necessity of patch management and vulnerability scanning.
1000039
557 followersView on X
ThreatCluster@threatcluster116d
Active Exploitation
CVE-2020-10148 in the SolarWinds Orion API allows unauthenticated remote attackers to execute API commands on Orion Platform versions 2019.4 HF5, 2020.2 and 2020.2 HF1 and has been actively exploited, Rapid7 reported. https://threatcluster.io/cluster/critical-authentication-bypass-in-solarwinds-orion-api-cve-2-03e8a682
Post summary
CVE-2020-10148 is a critical authentication bypass in SolarWinds Orion that allows remote execution and is actively exploited in the wild, as reported by Rapid7.
0000052
356 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	solarwinds	orion_platform	2019.4	-	-
App	solarwinds	orion_platform	2020.2	-	-
App	solarwinds	orion_platform	2020.2.1	-	-

Explore more

Back to dashboard solarwinds CVEs orion_platform vulnerabilities

What researchers are saying

CVE-2020-10148

ThreatCluster[verified]@threatclusterActive Exploitation

CVE-2020-10148 is a critical authentication bypass in SolarWinds Orion that allows remote execution and is actively exploited in the wild, as reported by Rapid7.

Kat@kat_katpaintsDisclosure

The tweet announces CVE-2020-10148 as a critical vulnerability in Dominion Democracy Suite Image Cast X, enabling unauthorized remote access to voting machines during the 2020 election, with no evidence of exploitation, PoC, patch, or false positive claim.

David@davidsheyiActive Exploitation

The statement identifies CVE-2020-10148 as actively exploited in supply-chain attacks to bypass authentication mechanisms.

David@davidsheyiActive Exploitation

CVE-2020-10148 was exploited in the SolarWinds breach, highlighting the necessity of patch management and vulnerability scanning.