Local Privilege Escalation Vulnerability in SolarWinds Patch Manager

CVE-2021-27240

Summary

The identified vulnerability exists in SolarWinds Patch Manager 2020.2.1, allowing local attackers to escalate privileges by exploiting a flaw in the DataGridService WCF service. The vulnerability arises from insufficient validation of user-supplied data, which can lead to deserialization of untrusted data. An attacker who has already executed low-privileged code on the target system could use this weakness to gain Administrator-level privileges and execute arbitrary code.

References