CVE-2021-27240

Name of the Vulnerable Software and Affected Versions: SolarWinds Patch Manager version 2020.2.1

Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the DataGridService WCF service due to the lack of proper validation of user-supplied data, resulting in deserialization of untrusted data. This can be leveraged to escalate privileges and execute arbitrary code in the context of Administrator.

Recommendations: For SolarWinds Patch Manager version 2020.2.1, consider disabling the DataGridService WCF service as a temporary workaround until a patch is available. Restrict access to the DataGridService to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.