Critical Authentication Bypass in SolarWinds Orion API (CVE-2020-10148)

The report details CVE-2020-10148, an authentication bypass in the SolarWinds Orion API that enables unauthenticated remote code execution by appending specific parameters to Request.PathInfo; affected versions include 2019.4 HF 5 and 2020.2 (without hotfix), the flaw was actively exploited in the wild and linked to the SUPERNOVA malware, and organizations are urged to apply December 2020 patches and harden IIS servers immediately.