CVE-2021-35225
mediumpriority · track · 26EPSS 0.008 · 58 %ileEUUSEPSS · scored 2026-10-28
Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- solarwinds network performance monitor≤ 2020.2.6nvdUScpe:2.3:a:solarwinds:network_performance_monitor:*:*:*:*:*:*:*:*
- solarwinds network performance monitor= 2020.2.6nvdUScpe:2.3:a:solarwinds:network_performance_monitor:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-35225cnnvd
- https://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_UScnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021110223cnnvd
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225cnnvd
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmenisa_euvd
- https://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_USenisa_euvd
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan