CVE-2024-0692 is a high severity remote code execution flaw in SolarWinds Security Event Manager (SEM), scored 8.8 by NVD and by SolarWinds. The advisory lists SEM 2023.4 and earlier as affected and SEM 2023.4.1 SR as the fix. Upgrade, because the flaw needs no login.
What's affected
The SolarWinds advisory says SEM 2023.4 and all prior versions are affected, and that the fix ships in SEM 2023.4.1 SR. NVD and the vendor agree on the rating: 8.8, High, with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Note the attack vector in that string is adjacent, not network. The record's reach is limited to the same network segment as the product, which narrows who can try it but still matters for an appliance that sits inside a trusted zone. The vendor titles the advisory deserialization of untrusted data, which maps to CWE-502. The advisory gives little more technical detail, and neither will this post.
How to check if you're exposed
In the SEM console, open the About or version information and read the version. If it shows 2023.4 or anything older, you are in the affected range. A version of 2023.4.1 SR or later carries the fix per the vendor.
SEM often runs as a virtual appliance, so you also want to know which network segments can reach its management and agent services. List the hosts that can talk to it. The vector says the attacker must be on an adjacent network, so a flat network with many users widens the pool.
What to do now
- Check the SEM version on every appliance you run, including lab and disaster recovery copies.
- Upgrade to SEM 2023.4.1 SR or later, following SolarWinds release notes for that version.
- Until you can upgrade, limit which hosts and segments can reach the SEM service ports.
- Review the appliance for unexpected accounts, scheduled jobs or outbound connections if it was exposed on a shared network.
- Add the SEM version to your asset inventory so future advisories are easy to match.
Why it matters
Deserialization flaws happen when software rebuilds objects from data sent by a client without checking what it contains. If the data can describe objects the program should never create, the program may end up running attacker chosen behavior. The result here, according to the record, is remote code execution by an unauthenticated user.
The target is a security event manager. It collects logs from across the network, so it holds sensitive records and usually has trusted connections to many systems. Code execution on such a box is a good position for someone who wants to hide activity or move sideways. The record does not list this CVE as known exploited, and the advisory I read does not say it has been used in attacks.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Does this need a login?
No. The record says an unauthenticated user can abuse the service.
Is the fix a patch or a new version?
The advisory names SEM 2023.4.1 SR as the fixed release. Follow the vendor's upgrade notes.
Sources
Last reviewed: 19 October 2026.
