How severe is CVE-2021-31474?

CVE-2021-31474 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-31474 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 94% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-31474?

CVE-2021-31474 affects Solarwinds Network Performance Monitor. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-31474?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2021-31474 published?

CVE-2021-31474 was published on 2021-05-21 and last updated on 2026-06-17.

CVE-2021-31474

CVE-2021-31474 is a critical-severity vulnerability in Solarwinds Network Performance Monitor with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 94% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-502.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
EPSS exploit prediction: 94% (100th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-502
Affected product: Solarwinds Network Performance Monitor
Published: 2021-05-21
Last modified: 2026-06-17

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SolarWinds.Serialization library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12213.

Frequently asked questions

What is CVE-2021-31474?: This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SolarWinds.Serialization library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12213.
How severe is CVE-2021-31474?: CVE-2021-31474 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-31474 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 94% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-31474?: CVE-2021-31474 affects Solarwinds Network Performance Monitor. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-31474?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2021-31474 published?: CVE-2021-31474 was published on 2021-05-21 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:solarwinds:network_performance_monitor:*:*:*:*:*:*:*:*

More vulnerabilities in Solarwinds Network Performance Monitor

CVE-2020-27869 — High (CVSS 8.8): This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network…
CVE-2018-13442 — High (CVSS 8.8): SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts…
CVE-2019-12864 — Medium (CVSS 5.5): SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of…
CVE-2021-35225 — Medium (CVSS 5.0): Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath…
CVE-2017-9538 — Medium (CVSS 4.9): The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows…
CVE-2019-12863 — Medium (CVSS 4.8): SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the…

All CVEs affecting Solarwinds Network Performance Monitor →

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

CVE-2026-41104 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose…
CVE-2026-43633 — Critical (CVSS 10.0): HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a…
CVE-2026-33819 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
CVE-2026-20131 — Critical (CVSS 10.0): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2026-25632 — Critical (CVSS 10.0): EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water…
CVE-2025-14931 — Critical (CVSS 10.0): Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.…

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →