CVE-2021-27240

CVE-2021-27240 is a local privilege escalation vulnerability affecting SolarWinds Patch Manager 2020.2.1. It stems from improper validation of user-supplied data within the DataGridService WCF service, leading to untrusted data deserialization. An attacker with low-privileged code execution can exploit this to gain Administrator privileges and execute arbitrary code. Rated 7.8 HIGH on CVSS, it requires local access and has a high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion.