Orion Platform SQL Injection Privilege Escalation Vulnerability
Priority HIGH 79CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.7432 99th percentileScored 2026-11-07
Fix Fixed Orion Platform (SolarWinds): 2022.2.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolarWinds | Orion Platform | 2022.2.3 and previous versions to before 2022.2.3 | 2022.2.3 | Patch available | CNA |
- Orion Platform VendorSolarWinds Affected 2022.2.3 and previous versions to before 2022.2.3 Fixed in 2022.2.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:* | up to 2022.2.0 | Vulnerable | SolarWinds |
- cpe:2.3:a:solarwinds:orion_platform:*:*:*:*:*:*:*:* Versions up to 2022.2.0 Vulnerable ·SolarWinds
Remediation
- Fix · CNA Orion Platform (SolarWinds) Fixed in 2022.2.3
Timeline
- 2026-10-02 Threatist record created from CVE-2022-36961
- 2026-10-03 Alias added: GHSA-g8wp-3x9j-448g
References
More SolarWinds Orion Platform vulnerabilities
- TI-2020-08199 Authentication bypass in SolarWinds Orion Platform KEVCVSS 3.1CRITICAL 9.8
- TI-2022-17164 SolarWinds Platform Deserialization of Untrusted Data CVSS 3.1HIGH 8.8
- TI-2021-14112 Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability CVSS 3.1HIGH 8.9
- TI-2021-14109 ActionPluginBaseView Deserialization of Untrusted Data RCE CVSS 3.1HIGH 8.9
- TI-2022-17818 SolarWinds Platform Deserialization of Untrusted Data Vulnerability CVSS 3.1HIGH 7.2
- TI-2020-16939 Path traversal in SolarWinds Orion Platform CVSS 3.1HIGH 7.2
Sources
- CVE-2022-36961 · CVE Program
- CVE-2022-36961 · NVD
- FIRST EPSS
- GHSA-g8wp-3x9j-448g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences