CVE-2023-35188 is an SQL injection flaw in a create statement in SolarWinds Platform, scored 8.0 High, that can lead to remote code execution. It needs a login. SolarWinds says version 2023.4.2 and earlier are affected and the fix is SolarWinds Platform 2024.1.
What's affected
Per SolarWinds' security advisory for this CVE, SolarWinds Platform 2023.4.2 and earlier are affected, and the fixed version is SolarWinds Platform 2024.1. The record points to the 2024.1 release notes as well. The advisory was published on 6 February 2024.
The flaw needs valid user credentials. The record's vector is adjacent network, low privileges and no user interaction, with high impact on confidentiality, integrity and availability. The advisory credits Piotr Bazydlo of Trend Micro Zero Day Initiative with the report, and says it has not been reported exploited beyond the original researcher's report.
How to check if you're exposed
Sign in to the SolarWinds web console and open the product version information, which shows the platform version in the footer and in the product details. SolarWinds documentation explains where to find it for your edition. Anything at or below 2023.4.2 is affected.
Also check who has accounts. The attack needs authentication, so a long list of low privilege or shared accounts widens exposure. List accounts, disable stale ones and require individual logins.
Check network reach too. The record's vector is adjacent network, so servers reachable only from management segments carry less risk than servers open to wide corporate networks.
What to do now
- Upgrade SolarWinds Platform to 2024.1 or later, following SolarWinds' upgrade guidance and release notes.
- Back up the database and configuration before the upgrade.
- Review and prune accounts, remove shared logins and enforce strong credentials.
- Restrict network access to the web console to management networks.
- Watch the SolarWinds security advisories page for new issues, and add the platform's version to your asset list.
Why it matters
SQL injection happens when input is placed into a database statement as code rather than passed as data. Here the statement is a create statement, and the advisory says it can lead to remote code execution, which means the database layer gives a route to the host.
Monitoring platforms are high value. They hold credentials for the systems they watch and they reach many networks. The login requirement is a real barrier, but in many companies the number of people who can log in to monitoring runs into the hundreds.
The weakness classes involved are CWE-89 (SQL Injection). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
SolarWinds, the record and NVD agree on High. The record scores it 8.0. The SolarWinds page I read gives the vector and the word High, and I did not see a separate number, so there is no conflict.
Try it yourself
Monitoring tools need monitoring too. This demo shows how continuous monitoring flags a new advisory against the versions you actually run.
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need credentials?
Yes. SolarWinds says valid user authentication is required.
Has it been exploited?
The SolarWinds advisory says it has not been reported exploited beyond the original researcher's report, and the record does not flag it as a CISA known exploited vulnerability. That can change.
Sources
Last reviewed: 19 October 2026.
