CVE-2021-35226 - CVE House
Back to Database
Status published Medium CVE-2021-35226

Hashed Credential Exposure Vulnerability

Vulnerability Description

An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-35226

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • SolarWinds would like to thank Preston Deason, Chad Larsen and Zachary Riezenman for reporting on the issue in a responsible manner.

References

More from SolarWinds

View All →
CVE-2025-40554
SolarWinds Web Help Desk Authentication Bypass Vulnerability
Critical 9.8
CVE-2025-40553
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
Critical 9.8
CVE-2025-40552
SolarWinds Web Help Desk Authentication Bypass Vulnerability
Critical 9.8
CVE-2025-40551
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
Critical 9.8
CVE-2025-40549
SolarWinds Serv-U Path Restriction Bypass Vulnerability
Critical 9.1

Affected Vendor

Affected Software

Network Configuration Manager
Vulnerable Versions:
2020.2.5 and previous version

Timeline

Official Publish: October 10th, 2022
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-326

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.