CVE-2024-52606 is a low severity (CVSS 3.5) server-side request forgery in SolarWinds Platform 2024.4.1 and previous versions. Input was not sanitised properly, which allowed a malicious web request. SolarWinds lists SolarWinds Platform 2025.1 as the fixed release, so schedule the upgrade.
What's affected
The SolarWinds advisory says SolarWinds Platform 2024.4.1 and previous versions are affected. The fixed software release is SolarWinds Platform 2025.1, which the release notes for 2025.1 also list.
The advisory credits an anonymous researcher working with Trend Micro Zero Day Initiative. It rates the severity as Low, and the CVSS vector in the advisory shows an adjacent network attack vector, low privileges, and a limited integrity impact only.
That makes this a routine upgrade item, not an emergency, but it shares a release with other fixes, so there is a good reason to move to 2025.1 anyway.
How to check if you're exposed
Read the Platform version from the SolarWinds web console, usually shown in the footer or in the settings page under details. If it reads 2024.4.1 or lower, it is affected.
Also check the network position of the server. The advisory vector gives an adjacent attack vector, so servers reachable only from restricted networks are exposed to fewer people. List who has accounts with the rights needed to reach the affected feature.
What to do now
- Read the SolarWinds Platform version on every installation.
- Plan the upgrade to 2025.1, following SolarWinds upgrade guidance and taking a backup first.
- Check the 2025.1 release notes for other security fixes included in the same release.
- Limit access to the web console to administrator networks.
- Review the accounts that have edit rights, and remove those that no longer need them.
Why it matters
The weakness is CWE-918 (Server-Side Request Forgery). In a server-side request forgery, an attacker gets the server to send a request on their behalf, so the request comes from inside the trusted network rather than from the attacker address. Depending on what the server can reach, that can expose internal services that are not meant to be public.
The low score reflects the limits in the vector: it needs a login, and the impact is small. Cases like this are good to schedule instead of rush, though management platforms hold broad network trust, so keep the upgrade on the plan. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-52606.
Quick check
Which release fixes CVE-2024-52606?
SolarWinds Platform 2025.1.
Is this urgent?
SolarWinds rates it Low. Include it in the normal upgrade plan, and move faster if the console is reachable from untrusted networks.
Sources
- SolarWinds advisory for CVE-2024-52606
- SolarWinds Platform 2025.1 release notes
- Gold entry for CVE-2024-52606
Last reviewed: 19 October 2026.
