CVE-2020-35216: 
Java vulnerability analysis and mitigation

A deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. The vulnerability, tracked as CVE-2020-35216, affects SolarWinds Patch Manager versions up to (excluding) 2020.2.6. An authenticated attacker with network access via HTTP can exploit this vulnerability to achieve Remote Code Execution (SolarWinds Advisory).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). It received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring low privileges (NVD Database).

If successfully exploited, this vulnerability can result in Remote Code Execution, potentially allowing an attacker to execute arbitrary commands on the affected system. The impact affects all three main security aspects - Confidentiality, Integrity, and Availability of the system (SolarWinds Advisory).

Users are advised to upgrade to Patch Manager version 2020.2.6 or later to address this vulnerability. SolarWinds has released this version specifically to patch the security issue (SolarWinds Release Notes).