CVE-2021-35220

Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.

• CWE-77

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htmPatch, Release Notes, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-EmailWebPage-Command-Injection-RCE-CVE-2021-35220?language=en_USMitigation, Patch, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/orion_platform_2020-2-6_release_notes.htmPatch, Release Notes, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Mitigate-the-EmailWebPage-Command-Injection-RCE-CVE-2021-35220?language=en_USMitigation, Patch, Vendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/Orion-Platform-2020-2-6-Hotfix-1?language=en_USPatch, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35220Vendor Advisory

Published

Aug 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35215Insecure deserialization leading to Remote Code Execution wa…8.8
• CVE-2021-35216Insecure Deserialization of untrusted data remote code execu…8.8
• CVE-2021-35217Insecure Deseralization of untrusted data remote code execut…8.8
• CVE-2021-35218Deserialization of Untrusted Data in the Web Console Chart E…8.8
• CVE-2021-35219ExportToPdfCmd Arbitrary File Read Information Disclosure Vu…4.9
• CVE-2021-3522GStreamer before 1.18.4 may perform an out-of-bounds read wh…5.5
• CVE-2021-35221Improper Access Control Tampering Vulnerability using Import…8.1
• CVE-2021-35222This vulnerability allows attackers to impersonate users and…9.6
• CVE-2021-35223The Serv-U File Server allows for events such as user login …8.8
• CVE-2021-35225Each authenticated Orion Platform user in a MSP (Managed Ser…6.4
• CVE-2021-35226An entity in Network Configuration Manager product is miscon…6.5
• CVE-2021-35227The HTTP interface was enabled for RabbitMQ Plugin in ARM 20…7.8