CVE-2016-3643
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by...
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
- Record
CVE-2016-3643- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
- Record
CVE-2016-3643- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2016-4668
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
- Record
EUVD-2016-4668- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fww7-75jj-wj62
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by...
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
- Record
GHSA-fww7-75jj-wj62- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
CISA KEV No score
SolarWinds Virtualization Manager Privilege Escalation Vulnerability
SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
- Record
CVE-2016-3643- Weakness
- CWE-264
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SolarWinds Virtualization Manager - Local Privilege Escalation | 2016-06-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-3643 is a high vulnerability (CVSS 7.8) in Solarwinds Virtualization Manager, published June 17, 2016. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.67%, the 89th percentile. No source names a fixed version.
References
exploit-db.com/exploits/39967
seclists.org/fulldisclosure/2016/Jun/26
packetstormsecurity.com/files/137487/Solarwinds-Virtualization-Manager-6.3.1-Privilege-Escalation.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3643
nvd.nist.gov/vuln/detail/CVE-2016-3643
github.com/advisories/GHSA-fww7-75jj-wj62