CVE-2021-35225

Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmVendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_USRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmVendor Advisory
• https://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_USRelease Notes, Vendor Advisory
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225Vendor Advisory

Published

Oct 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35219ExportToPdfCmd Arbitrary File Read Information Disclosure Vu…4.9
• CVE-2021-3522GStreamer before 1.18.4 may perform an out-of-bounds read wh…5.5
• CVE-2021-35220Command Injection vulnerability in EmailWebPage API which ca…7.2
• CVE-2021-35221Improper Access Control Tampering Vulnerability using Import…8.1
• CVE-2021-35222This vulnerability allows attackers to impersonate users and…9.6
• CVE-2021-35223The Serv-U File Server allows for events such as user login …8.8
• CVE-2021-35226An entity in Network Configuration Manager product is miscon…6.5
• CVE-2021-35227The HTTP interface was enabled for RabbitMQ Plugin in ARM 20…7.8
• CVE-2021-35228This vulnerability occurred due to missing input sanitizatio…4.7
• CVE-2021-35229Cross-site scripting vulnerability is present in Database Pe…6.1
• CVE-2021-3523A flaw was found in 3Scale APICast in versions prior to 2.11…7.5
• CVE-2021-35230As a result of an unquoted service path vulnerability presen…6.7