CVE-2023-50395 is a high severity SQL injection flaw in the SolarWinds Platform that can lead to remote code execution. NVD scores it 8.0. The vendor lists versions up to 2023.4.2 as affected and fixed the problem in SolarWinds Platform 2024.1, so upgrade to that release or later.
What's affected
The SolarWinds advisory lists "2023.4.2 and previous versions" of the SolarWinds Platform as affected. The fix shipped in SolarWinds Platform 2024.1, and the vendor's release notes for that version are the reference to read.
The NVD record is dated 2024-02-06 and scores the flaw 8.0 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The advisory also rates it High, so the two sources agree on severity.
Two parts of that vector matter for triage. The attack vector is adjacent, which means an attacker needs to reach the platform from a nearby network position rather than from anywhere on the internet. The privileges required are low, which matches the description: exploitation needs an authenticated user. This is not an anonymous bug, but any account with ordinary access is a starting point.
How to check if you're exposed
Find the installed SolarWinds Platform version through your administration pages and compare it with 2023.4.2 and 2024.1. Anything at 2023.4.2 or below is in the affected range. Anything at 2024.1 or later has the vendor fix.
If you run several SolarWinds Platform modules on one server, remember they share the platform version. Upgrading one module without checking the platform release can leave the underlying flaw in place, so confirm the platform number, not only the module number.
Also look at who can log in. Because exploitation needs a valid account, a list of active users, service accounts and integrations tells you how many people could have used the flaw before you patched.
What to do now
- Confirm the installed SolarWinds Platform version and whether it is 2023.4.2 or earlier.
- Plan the upgrade to SolarWinds Platform 2024.1 or later and read the 2024.1 release notes for upgrade prerequisites.
- The advisory lists no workaround, so do not rely on configuration changes in place of the upgrade.
- Until the upgrade is done, limit network access to the platform web interface to the management networks that need it.
- Review accounts with access and remove any that are unused, shared or over privileged.
Why it matters
The weakness is SQL injection, tracked as CWE-89. SQL injection happens when input from a user is placed into a database statement in a way that lets it change the statement itself. The advisory describes the problem as arising "using an update statement", so a write operation is involved, not only a read.
The consequence here goes past data exposure. The vendor describes the result as remote code execution, which means a database level flaw can become control of the host that runs the monitoring platform. Monitoring servers often hold credentials for the systems they watch, so a compromise can reach well beyond one machine.
This CVE is not in the CISA Known Exploited Vulnerabilities catalog according to the record, and neither fetched source reports exploitation in the wild.
Quick check
Does an attacker need an account to use CVE-2023-50395?
Yes. The advisory states that exploitation requires user authentication. The CVSS vector also shows low privileges required and an adjacent network attack vector.
Is there a workaround short of upgrading?
The vendor advisory lists none. The stated remedy is SolarWinds Platform 2024.1 or later.
Sources
Last reviewed: 19 October 2026.
