CVE-2016-3643
KEVSolarWinds Virtualization Manager Privilege Escalation Vulnerability
Description
SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HPublishedJun 17, 2016
Last modifiedJun 17, 2026
Added to KEVNov 3, 2021
Remediation dueMay 3, 2022
References
- packetstormsecurity.com/files/137487/Solarwinds-Virtualization-Manager-6.3.1-Privilege-Escalation.htmlExploitThird Party Advisory
- seclists.org/fulldisclosure/2016/Jun/26Mailing ListThird Party Advisory
- exploit-db.com/exploits/39967/ExploitThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3643US Government Resource
0 recent articles mention this CVE
69
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1638 days
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 3.7% · top 10% of all CVEs
- Weakness
- CWE-264
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.